AD~A07fl  395  MASSACHUSETTS  INST  OF  TECH  CAMBRIDGE  ARTIFICIAL  INTE— ETC  F/6  5/10 
NON-MONOTONIC  LOGIC  I.  REVISION. (U) 

JUL  79  D  MCDERMOTT  »  J  DOYLE  N00014-75-C-0643 

UNCLASSIFIED  AI-M-4B68  _  _ _ ML 


AO 

A078395 


*1  tf* 

«  & 

END 

DATE 

FILMED 

1  —  80 

DOC 

i\Ob‘ 


UNCLASSIFIED 


SECURITY  CUSitflOTIQH  OF  THIS  PAGE  flWiwi  Dolm  Cntorod) 


REPORT  DOCUMENTATION  PAGE 


READ  INSTRUCTIONS 
BEFORE  COMPLETING  FORM 


I  REPORT  NUMBER 

AIM  486b 


2.  GOVT  ACCESSION  HO.  J.  RECIPIENT'S  CATALOG  NUMBER 


Gu 


4.  TITLE  f«nd  SublllleJ 


Non-Monotonic  Logic  I 

fe  via' art  * 


S.  .type  of  report  a  period  covered 

-  Ay-  mm  ■»,—  —  ■  ■ 

memorandum  Ke/-/., 


^  7#AU  Th iORT »2 

Drew^I. 

oi-/ 

CO 
00 


Drew /McDermott 
Jon /Doyle 


7 


/ 


9.  PERFORMING  ORGANIZATION  NAME  AND  ADDRESS 


Artificial  Intelligence  Laboratory 
5**5  Technology  Square 
Cambridge,  Massachusetts  02139 


10.  PROGRAM  ELEMENT.  PROJECT,  TASK 
AREA  *  WORK  UNIT  NUMBERS 


It.  CONTROLLING  OFFICE  NAME  AND  ADDRESS 

Advanced  Research  Projects  Agency 
1400  Wilson  Blvd 
Arlington,  Virginia  22209 


14  MONITORING  AGENCY  NAME  8  ADDRESSf//  dlltoront  tram  Controlling  Olll CO) 

Office  of  Naval  Research 
Information  Systems 

Arlington,  Virginia  22217  ^  ^ 


16  DISTRIBUTION  STATEMENT  (ol  Ihlo  Roporl) 


is.  security  class,  (oi  t m«  roponj 

UNCLASSIFIED 


IS*.  DECLASSI  FlCATION/ DOWNGRADING 

schedule 


Distribution  of  this  document  is  unlimited. 


r  04 


D  DC 


17.  DlSTRIBlitlOM-STATEMENT  (of  thm  mbatrmct  an  tar  ad  In  Black  20,  it  dttiarant  from  Raport) 


18.  supplementary  NOTES 


None 


79  12  1 


u 


0  8 


KEY  WORDS  (Contlnuo  on  rovoroo  mldo  It  nocoooory  ond  Idontlly  by  block  nuntbor) 


artificial  intelligence 
consistency 
default  reasoning 
incomplete  information 


logic 
non-monotonic  logic 
truth  maintenance 
semantics 


CA 


h 


Wi  ji 


0  ABSTRACT  (Continue  on  rovoroo  oldo  It  nocooooty  and  Idontlly  by  block  numbot) 

*Non-montonic^  logical  systems  are  logics  in  which  the  introduction  of  new 
axioms  can  invalidate  old  theorems.  Such  logics  are  very  important  in  modeling 
the  beliefs  of  active  processes  which,  acting  in  the  presence  of  incomplete  in¬ 
formation,  must  make  and  subseauently  revise  assumptions  in  light  of  new  obser¬ 
vations.  We  present  the  motivation  and  history  of  such  logics.  We  develop  and 
proof  theories,  a  proof  procedure,  and  applications  for  one  non-monotonic  logic 
In  particular,  we  prove  the  completeness  of  the  non-monotonic  predicate  calculu 
and  the  decidability  of  the  non-monotonic  sentential  calculus. 


V 


DD  ,  X  »  1473 


EDITION  OF  I  NOV  65  IS  OBSOLETE 
S/N  0  10 1-1114-  660  1  | 


UNCLASSIFIED! 


MASSACHUSETTS  INSTITUTE  OF  TECHNOLOGY 
ARTIFICIAL  INTELLIGENCE  LABORATORY 


A.  I.  Memo  4RLb 


August  1918 
revised  July  1979 


NON  MONOTONIC  LOGIC  I 


Drew  McDermott 
Department  o(  Computer  Science 
Yale  University 


Jon  Doyle 

Artificial  Intelligence  Laboratory 
Massachusetts  Institute  of  Technology 


Abstract:  "Non -monotonic"  logical  systems  are  logics  in  which  the  introduction  of  new 
axioms  can  invalidate  old  theorems.  Such  logics  are  very  important  in  modeling  the 
beliefs  of  active  processes  which,  acting  in  the  piesence  of  incomplete  information,  must 
make  and  subsequently  revise  assumptions  in  light  of  new  observations.  We  present  the 
motivation  and  history  of  such  logics.  We  develop  model  and  proof  theories,  a  proof 
procedure,  and  applications  for  one  non  monotonic  logic.  In  particular,  we  prove  the 
completeness  of  the  non-monotonic  predicate  calculus  and  the  decidability  of  the  non¬ 
monotonic  sentential  calculus.  We  also  discuss  characteristic  properties  of  this  logic  and  its 
relationship  to  stronger  logics,  logics  of  incomplete  information,  and  truth  maintenance 
systems. 


Keywords:  artificial  intelligence,  belief  revision,  consistency,  default  reasoning, 
incomplete  information,  logic,  logic  of  belief,  modal  logic,  non -monotonic  logic,  proof 
theory,  self-reference,  semantics,  truth  maintenance 

A 

Fannie  and  John  Hertz  Foundation  Fellow 


This  research  was  conducted  at  the  Aitificial  Intelligence  Laboratory  of  the  Massachusetts 
Institute  of  Technology.  Support  for  the  Laboratory's  artificial  intelligence  research  is 
provided  in  part  by  the  Advanced  Research  Projects  Agency  of  the  Department  of  Defense 
under  Office  of  Naval  Research  contract  number  N00014-7S-C-0643,  and  in  part  by  NSF 
Cram  MCS77-0482R.  - 


2 


Acknowlcdgcinenis 

Wr  wish  to  thank  Ceiald  Jay  Sussman,  Rohit  Parikh,  David  Harel,  Mitch 
Matcus,  I.ucia  Vairia,  and  Vaughan  Pratt  for  helpful  criticisms  and  comments.  Drew 
McDermott  acknowledges  the  support  of  a  Josiah  Willard  Cibbs  instructorship.  Jon  Doyle 
thanks  the  Fannie  and  John  Hertz  Foundation  for  supporting  his  research  with  a  graduate 
fellowship. 

Contents 

1.  I  lit  induction  3 

2.  The  Problem  of  Incomplete  Knowledge  3 

3.  Appioachrs  to  Non  monotonic  Logic  and  the  Semantical  Difficulties  S 

4.  Linguistic  Preliminaries  10 

5.  Pi  oof  Theoretic  Operators  11 

6.  Model  Theory  IS 

7.  Fixed  Points  of  Theories  16 

fl.  The  Evolution  of  Theories  19 

9.  A  Pioof  Procedure  for  Non- Monotonic  Statement  Theories  24 

10.  The  Truth  Maintenance  System  30 

11.  Discussion  33 

References  3S 


I.  I nt roducl ion 


"Non  monotonic"  logical  systems  air  logics  in  which  the  introduction  of  new 
axioms  can  invalidate  old  theotems.  Such  logics  ate  very  important  in  modeling  the 
beliefs  of  active  piocesses  which,  actmp,  in  the  presence  of  incomplete  information,  must 
make  and  subsequently  levise  assumptions  in  light  of  new  observations.  We  present  the 
motivation  and  lustniy  of  such  logics.  We  develop  model  and  pioof  theories,  a  proof 
piocedure,  and  applications  foi  one  non  monotnnic  logic.  In  paiucular,  we  prove  the 
completeness  of  the  non-monotonic  picdicate  calculus  and  the  decidability  of  the  non¬ 
monotonic  sentential  calculus.  We  also  discuss  characteristic  properties  of  this  logic  and  its 
relationship  to  stronger  logics,  logics  of  incomplete  information,  and  truth  maintenance 
systems. 


2.  The  Problem  of  Incomplete  Knowledge 

I  he  relation  between  formal  logic  and  the  operation  of  the  mind  has  always 
been  unclear.  On  one  hand,  logic  was  originally  the  study  of  the  "laws  of  thought,"  and 
has  lemamrd  at  least  in  principle  a  prescriptive  theory  of  the  operation  of  the  "ideal" 
mind.  ON  the  othei  hand,  many  logicians  have  often  been  unduly  uninterested  in 
01  dinar v  "non  ideal"  mental  phenomena.  Some  of  the  more  striking  differences  between 
properties  of  formal  logics  and  mental  phenomenology  occur  in  situations  dealing  with 
perception,  ambiguity,  common  sense,  causality  and  prediction.  One  common  feature  of 
these  problems  is  that  they  seem  to  involve  working  with  incomplete  knowledge. 
Perception  must  account  foi  the  noticing  of  overlooked  features,  common  sense  ignores 
myriad  special  exceptions,  assignees  of  blame  can  be  misled,  and  plans  for  the  future  must 
consider  nevei -to  be  realized  contingencies.  It  is  this  apparently  unavoidable  making  of 
mistakes  in  t hose  cases  that  leads  lo  some  of  the  deepest  problems  of  the  formal  analysis  of 
mind. 


Some  studies  of  these  problems  occur  in  the  philosophical  literature,  the  most 
relevant  heie  being  Reseller's  [363  analysis  of  comiterf actual  conditionals  and  belief- 
contravening  hypotheses.  In  aitificial  intelligence,  studies  of  perception,  ambiguity  and 
common  sense  have  led  to  knowledge  representations  which  explicitly  and  implicitly 
embody  much  information  about  typical  cases,  defaults,  and  methods  for  handling 
mistakes.  1 20 ,  3!>3  Studies  of  problem  solving  and  acting  have  attempted  representing 
predictive  and  causal  knowledge  so  that  decisions  to  act  require  only  limited 
contemplation,  and  that  actions,  their  variations,  and  their  effects  can  be  conveniently 
described  and  computed,  [ft,  9,  10,  113  Indeed,  one  of  the  original  names  applied  to  these 
efforts,  "heuristic  programming",  stems  from  efficiency  requirements  forcing  the  use  of 
methods  which  occasionally  arc  wiong  nr  which  fail.  The  possibility  of  failure  means  that 
formalizations  of  reasoning  in  these  aieas  must  capture  the  process  of  revisions  of 
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perceptions,  predictions,  deductions  and  other  beliefs. 

In  fact,  the  need  to  irvise  beliefs  also  occms  in  certain  implementations  of 
deductive  systems  working  within  traditional  logics  Much  work  has  been  done  on 
mechanized  pi  oof  techmqties  for  the  fu  st  oide*  predicate  calculus,  f  29,  30,  38]  Incomplete 
information  is  irpresemed  m  these  systems  as  disjunctions  of  the  several  possibilities  where 
the  individual  disjoints  may  be  independent  of  the  axioms  being  used,  that  is,  cannot  be 
proven  or  conti adteted  by  aiguments  f i cun  the  axioms.  Thus,  proof  procedures  engage  in 
Oise  splitting,  in  which  dis|tincts  are  considered  in  a  case-by-case  fashion.  At  any  given 
time,  the  proof  procedure  will  have  some  set  of  current  assumptions,  from  which  the 
current  set  of  foimulas  has  been  derived.  If  failures  in  the  proof  attempt  lead  to 
investigating  new  splits,  and  so  change  the  set  of  current  assumptions,  the  current  set  of 
derived  formulas  must  also  he  updated,  for  it  is  the  curient  set  of  formulas  on  which  the 
proof  procedure  liases  its  anions. 

Classical  symbolic  logic  lacks  tools  for  describing  how  to  revise  a  formal  theory 
to  deal  with  inconsistencies  caused  by  new  information,  t  his  lack  is  clue  to  a  recognition 
that  the  genet al  pioblcm  of  finding  and  selecting  among  alternate  revisions  is  very  hard. 
(For  an  attack  on  this  problem,  see  Reseller  [38],  Quine  and  Ullian  [33]  survey  the 
complexities.)  Although  logicians  have  been  able  to  ignoie  this  problem,  philosophers 
and  reseaichers  in  amficial  intelligence  have  been  forced  to  face  it  because  humans  and 
computational  models  ate  subject  to  a  continuous  flow  of  new  information.  One  important 
insight  gained  through  computational  expeiience  is  that  there  are  at  least  two  different 
problems  involved,  what  might  he  called  "routine  revision"  and  "world -model 
reorganization". 

Wen  Id  model  reorganization  is  the  very  hard  problem  of  revising  a  complex 
model  of  a  situation  when  it  turns  nut  to  be  wtong.  Much  of  the  complexity  of  such 
models  usually  stems  fioni  pails  of  the  model  relying  on  descriptions  of  other  parts  of  the 
model,  such  as  inductive  hypotheses,  testimony,  analogy,  and  intuition.  An  example  of 
such  large-scale  reorganization  would  be  the  icvision  of  a  Newtonian  cosmology  to  account 
for  perturbations  in  Mercury's  orbit.  Less  grand  examples  are  children's  revisions  of  their 
world -models  as  discovered  by  Piaget,  and  the  revision  of  one's  opinion  of  a  friend  upon 
discovering  his  dishonesty. 

Routine  revision,  on  the  otliei  hand,  is  the  problem  of  maintaining  a  set  of  facts 
which,  although  expressed  as  universally  true,  have  exceptions.  For  example,  a  program 
may  have  the  belief  that  all  animals  with  beaks  ate  buds.  Telling  this  program  about  a 
platypus  will  cause  a  contradiction,  but  intuitively  not  as  serious  a  contradiction  as  those 
requiring  total  reorganization.  The  relative  simplicity  of  this  type  of  revision  problem 
stems  fiom  the  statement  itself  expressing  what  tevisions  ate  appropriate  by  referring  to 
possible  exceptions.  Such  relatively  easy  cases  include  many  forms  of  inferences,  default 
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assumption';,  anri  observations. 

Classical  logits,  by  lumping  all  contradictions  together,  has  overlooked  the 
possibility  of  handling  the  easy  ones  by  expanding  the  notation  in  which  rules  are  stated. 
I  hat  is,  wp  could  have  avoided  this  problem  by  stating  the  belief  as  "If  something  is  an 
animal  with  a  beak,  then  milns  fnovtn  otherwise,  it  is  a  bird."  If  we  allow  statements  of 
this  kind,  the  problem  becomes  how  to  coordinate  sets  of  such  rules.  Each  such  statement 
may  be  seen  as  providing  a  piece  of  advice  about  belief  revision;  for  this  approach  to 
make  sense,  all  the  little  pieces  of  advice  must  determine  a  unique  revision.  This  is  the 
subject  of  tins  paper.  Of  cotnse,  if  we  are  successful,  the  world-model  reorganization 
problem  will  still  be  unsolved.  Rut  we  hope  factoring  out  the  routine  revision  problem  will 
make  the  more  difficult  problem  clearer. 

3.  Approaches  to  Noii-Monotoiiic  l  ogic  and  the  Semantical  Difficulties 

The  study  of  the  problem  of  formalizing  the  process  of  revision  of  beliefs  has 
been  almost  completely  confined  to  the  practical  side  of  artificial  intelligence  research, 
where  much  work  has  been  done.  [6,  1?.,  26,  4?.]  Theoretical  foundations  for  this  work 
have  been  lacking.  This  paper  studies  the  foundations  of  these  forms  of  reasoning  with 
revisions  which  we  term  non  monotonic  logic. 

Traditional  logics  ate  called  monotonic  because  the  theorems  of  a  theory  are 
always  a  subset  of  the  theorems  of  any  extension  of  the  theory.  (This  name  for  this 
property  of  classical  logics  was  used,  after  a  suggestion  by  Piatt,  in  Minsky's  [28] 
discussion.  Hayes  1.111  has  called  this  the  "extension"  property.)  In  this  paper,  by  theory 
wr  will  mean  a  set  of  axioms.  A  more  precise  statement  of  monotonicity  is  this:  if  A  and 
B  are  two  theories,  and  A  c  R,  then  Th(A)  <:  Th(  B) ,  where  Th(S)  =  {|j:  SEp}  is  the  set 
of  theorems  of  S.  We  will  be  even  more  piecise  about  the  definition  of  E  in  Section  S. 

Monotonic  logics  lack  the  phenomenon  of  new  information  leading  to  a  revision 
of  old  conclusions.  We  obtain  non-monotonic  logics  from  classical  logics  by  extending 
them  with  a  modality  ("consistent")  well-known  in  artificial  intelligence  circles,  and  show 
that  the  resulting  logics  have  well-founded,  if  unusual,  model  and  proof  theories.  We 
inttoduce  the  proposition -forming  modality  M  (read  "consistent").  Informally,  Mp  is  to 
mean  that  p  is  consistent  with  everything  believed.  (See  [24].)  Thus  one  small  theory 
employing  this  modality  would  be 

(1)  noon  A  Mf  sun-shmingl  ^  sun  shining 

(2)  noon 

(3)  eclipse  -■»  •’Min-shining, 


special 
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in  which  wf  can  piove 

(4)  Min-shining. 

If  wf  acid  t hr  axiom 

(5)  edip 

thru  (4)  is  inconsistent,  so,  l>v  (1),  (4)  is  not  a  theorem  of  the  extended  theory. 

I  lie  use  of  non  monotonic  techniques  has  some  history,  but  until  recently  the 
intuitions  underlying  these  techniques  weie  inadequate  and  led  to  difficulties  involving  the 
semantics  of  nonmonotonic  inference  rules  in  certain  cases.  We  mention  some  of  the 
guises  in  which  non-monotonic  reasoning  methods  and  belief  revising  processes  have 
appeared. 

Scnven  [40,  411  proposed  that  explanations,  and  in  particular  historical 
explanations  of  rational  actions  or  decisions,  are  based  not  on  universal  or  statistical  laws, 
but  rather  on  truisms  or  more  generally,  what  he  teims  "normic"  statements.  Normlc 
statements  include  such  statements  as  "In  delicate  circumstances,  rational  men  act 
cautiously, "  or  "All  murders  are  committed  from  motives  of  revenge,  lust,  jealousy,  hate, 
greed,  oi  fear."  Such  statements  frequently  involve  terms  such  as  "naturally,"  "normally," 
"typically,"  "tendency,"  "ought,"  "should,"  and  others.  Normic  statements  provide 
plausible  explanations  of  actions  or  situations,  explanations  which  may  be  invalidated  by 
providing  exceptions,  special  cases,  or  other  mediating  circumstances;  that  is,  instances  of 
normic  statements  are  defeasible.  In  this  wav,  normic  statements  seem  closely  related  to 
statements  expressible  in  non-monotonic  logic.  Scnven  pointed  out  that  while  in  some 
cases  normic  statements  could  imply  statistical  statements  and  so  have  some  predictive 
power,  in  other  cases  normic  statements  can  only  supply  coherent  explanations,  cannot  rule 
out  alternative  coherent  arguments,  and  thus  fail  to  have  predictive  power.  De  Kleer  [4] 
amplifies  this  point  in  considering  explanations  of  the  behavior  of  designed  artifacts.  As 
we  shall  see  in  this  paper,  this  circumstance  is  also  highly  suggestive  of  non-monotonic 
logic. 

In  PLANNER  C123,  a  programming  language  based  on  a  negationless  calculus, 
the  THNOT  primitive  formed  the  basis  of  non -monotonic  reasoning.  TIINOT,  as  a  goal, 
succeeded  only  if  its  argument  failed,  and  failed  otherwise.  Thus  if  the  argument  to 
THNOT  was  a  formula  to  be  proved,  the  THNOT  would  succeed  only  if  the  attempt  to 
piove  the  embedded  formula  failed.  In  addition  to  the  non-monotonic  primitive  THNOT, 
Pl.ANNKR  employed  antecedent  and  erasing  piocrdurrs  to  update  the  data  base  of 
statements  of  beliefs  when  new  deductions  weie  made  or  actions  taken.  Unfortunately,  it 
was  up  to  the  user  of  these  proceduies  to  make  sure  that  there  were  no  circular 
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•dependencies  01  mutual  |u oof s  between  beliefs.  Such  circularities  could  lead  to,  for 
example,  mois  of  gioundless  belief  (clue  to  two  mutually  supporting  beliefs)  or  non- 
termmatmg  progiams  (a  moie  terbtucal  but  no  less  nutating  problem). 

Two  related  foims  of  non -monotonic  deductive  systems  are  those  described  by 
McCarthy  and  Mayes  1241  and  Sandewall  [391  McCaithy  and  Hayes  give  some  indications 
oi  bow  actions  might  t>e  descubed  using  modal  operators  like  "noimally"  and  "consistent", 
but  present  no  detailed  guidelines  on  how  such  operators  might  be  carefully  defined. 
Sandewall,  in  a  deductive  system  applied  to  the  frame  pioblem  (which  is  basically  the 
problem  of  efficiently  repiesenting  the  effects  of  actions;  see  till)  used  a  deductive 
irpresentation  of  non  monotomr  tides  based  on  a  pi inutive  called  UNLESS.  This  was  used 
to  deduce  conditions  of  situations  resulting  from  actions  except  in  those  cases  where 
piopetties  of  the  action  changed  the  extant  conditions.  Thus  one  might  say  that  things 
retain  then  color  unless  painted. 

Sandewall1  s  interpretation  of  UNLESS  was  in  accord  with  then  current  intuitions: 
UNLESS(p)  is  tine  if  p  is  not  deducible  fiom  the  axioms  using  the  classical  first-order 
inference  Miles.  Unfortunately,  tins  definition  has  several  problems,  as  pointed  out  by 
Sandewall.  One  problem  is  that  it  can  happen  that  both  p  and  UNLESS(p)  ate  deducible, 
since  from  a  rule  like  "fiom  UNI.FSS(C)  infer  P"  D  ran  be  inferred,  but  at  the  same  time 
UNLESS(  0)  is  also  deducible  since  P  is  not  deducible  by  classical  rules.  These  problems 
aie  partly  due  to  the  dependence  of  the  notion  of  "deducible"  on  the  intention  of 
deduction  rules  based  on  "not  deducible".  This  question -begging  definition  leads  to 
perplexing  questions  of  beliefs  when  complicated  tclations  between  UNLESS  statements  are 
present.  For  example,  given  the  axioms 

■  A 

A  A  Unlcss(  R)  3  C 

A  a  Unlcss(C)  3 

we  are  faced  with  the  somewhat  paradoxical  situation  that  either  B  or  C  can  be  deduced, 
but  not  both  simultaneously.  On  the  other  hand,  in  the  axiom  system 

A 

A  A  Unless!  B)  3  C 

A  A  Unless! C)  3  0 

A  A  Unless!  D)  j  E, 

one  would  expert  to  see  A,  0  and  E  believed,  and  B  and  R  not  believed. 


One  might  be  tempted  to  dismiss  these  anomalous  cases  as  uninteresting.  \n  fact, 
such  rases  are-  not  pet  verse;  rather,  they  occur  naturally  in  many  applications.  The 
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common  wav  they  air  intioduced  is  by  employing  assumptions  which  require  fuither 
assumptions  to  he  made. 

Spurred  I » v  Sandew, ill's  presentation  of  the  problems  ansing  through  such  non- 
monotonic  infeience  tules,  Ktanrosil  1 17]  considered  sets  of  inference  rules  of  the  form 

"From  Fp,  l/q,  infer  Fr", 

whne  F  and  F  aie  lokens  of  the  meta  language  and  the  number  of  antecedents  can  be 
arbitral v.  Kramosil  defined  the  set  of  theorems  in  such  a  system  as  the  intersection  of  all 
subsets  of  the  language  closed  under  the  inference  rules,  lie  noted  that  this  set  may  not 
itself  be  closed  under  the  inference  rules,  and  showed  that  in  the  special  case  in  which  the 
mtei eme  inles  pirerrve  luith  values  (that  is,  are  effectively  monotonic)  that  if  the  set  of 
theoicnu  of  the  monotnmc  inference  uiles  alone  is  also  closed  with  respect  to  the  non¬ 
monotonic  inference  rules,  then  this  set  is  the  set  of  non-monotomc  theoiems.  Kramosil's 
conclusion  was  that  a  set  of  inference  rules  defines  a  formalized  theory  (one  in  which  all 
foimulas  have  a  well-defined  truth  value)  if  and  only  if  this  same  theory  is  that  of  the 
monotomr  inference  rules  alone,  which  he  interprets  to  mean  that  the  non -monotonic  rules 
aie  either  useless  or  meaningless. 

As  we  will  show  in  this  paper,  Kramosil's  jnterpietation  was  too  pessimistic  with 
regard  to  the  possibility  of  fotmalizing  such  rules  and  their  unusual  properties.  As  we 
have  signed  above,  the  purpose  of  non-monotomc  inference  rules  is  not  to  add  certain 
knowledge  where  them  is  none,  but  rather  to  guide  the  selection  of  tentatively  held  beliefs 
in  the  hope  that  fiuilful  investigations  and  good  guesses  will  result.  This  means  that  one 
should  not  a  prion  expert  non-monotomc  rules  to  derive  valid  conclusions  independent  of 
the  monotonic  rules.  Rather  one  should  expect  to  he  led  to  a  set  of  beliefs  which  while 
perhaps  eventually  shown  incorrect  will  meanwhile  coherently  guide  investigations. 

Non  monotonic  inference  titles  need  not  appear  in  the  explicit  fotms  discussed 
by  Kramosil.  Many  authors  have  described  artificial  intelligence  programs  which  exhibit 
non -monotonic  behavior  only  implicitly.  Non -monotonicity  in  these  systems  stems 
typically  from  extra -logical  devices.  For  example,  one  can  effect  changes  in  beliefs  (as 
opposed  to  inferences)  by  using  extra  logical  SI  RIPS-like  (8]  operators.  Conflict 
resolution  strategics,  which  use  production  rule  oideiings  and  specificity  criteria  to 
determine  the  next  system  action,  also  induce  non  monotonic  behavior.  ([15]  and  [31]  in 
fact  tetm  this  property  of  their  systems  "non -monotonicity".) 

One  class  of  non  monotonic  inferences  consist  of  what  might  be  called  "minimal" 
infetences,  m  wlurh  a  minimal  model  fni  some  set  of  beliefs  is  assumed  by  assuming  the 
set  of  beliefs  to  he  a  complete  description  of  a  stale  of  affairs.  Joshi  and  Rosenschem  [16] 
descnbe  a  partial  matching  procedure  based  on  the  operation  of  taking  least  upper  bounds 
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in  a  lattice  ol  vets  of  belief*.  This  lias  the  effect  of  assuming  just  enough  additional 
information  to  allow  a  drsjied  |iaitial  match  to  succeed.  McCarthy  [2S1  outlines  a 
f’i ocedui p  railed  "mnimsct iption",  in  which  the  current  partial  extension  of  some 
predicate  is  assumed  to  he  fhr  complete  extension.  Of  course,  new  examples  of  the 
predication  can  invalidate  pievious  completeness  assumptions.  Reiter  [34]  analytes  the 
i elated  technique  of  assuming  false  all  element, sty  piedications  not  explicitly  known  true. 
He  outlines  some  conditions  mailer  which  data  bases  remain  consistent  under  this  "closed 
woild  assumption",  and  shows  ceitam  fomas  of  data  bases  to  be  naturally  consistent  with 
this  assumption.  However,  the  dosed  woild  assumption  does  not  seem  to  allow  for  any 
locality  ot  definition  of  defaults,  since  it  applies  this  assumption  to  all  primitive  predicates, 
and  dops  not  allow  defaults  applied  to  defined  (Medicates.  Circumscription,  on  the  other 
hand,  would  seem  to  lie  applicable  to  any  predicate  whatever.  Although  they  describe 
tools  fot  nonmonotonic  reasoning,  none  of  these  authors  discuss  the  problem  of  revision 
of  beliefs. 


These  problems  weic  mostly  resolved  in  the  Truth  Maintenance  System  (  I  MS)  of 
Doyle  [f>]  and  related  systems  [21,  23]  in  which  each  statement  has  an  associated  set  of 
implications,  each  of  which  repiesents  a  reason  for  holding  the  statements  as  a  belief. 
I  hrse  justifications  are  used  to  determine  the  set  of  current  beliefs  by  examining  the 
recorded  justifications  to  find  well  founded  support  (non-circular  proofs)  whenever 
possible  for  each  belief.  When  hypotheses  change,  these  justifications  are  again  examined 
to  update  the  set  of  current  beliefs.  This  scheme  provides  a  more  accurate  version  of 
antecedent  and  etasing  pioceriurrs  of  PLANNER  without  the  need  to  explicitly  check  for 
citcular  ptoofs.  The  nonmonotonic  capability  appears  as  a  type  of  justification  which  is 
the  static  analogue  of  thp  PLANNER  TIINOT  piinutive.  Part  of  the  justification  of  a 
belief  ran  be  the  lack  of  valid  justifications  for  some  other  possible  program  belief.  This 
allows,  for  example,  belirf  in  a  statement  to  be  justified  whenever  no  proof  of  the 
negation  of  the  statement  is  known.  Tins  representation  of  non -monotonic  justifications, 
in  combination  with  the  belief  revision  algorithms,  produced  the  first  system  capable  of 
pei forming  the  routine  revision  of  apparently  inconsistent  theories  into  consistent  theories. 
Part  of  this  revision  process  is  a  backtracking  scheme  called  dependency -directed 
backtracking.  [42]  We  will  analyze  this  system  in  more  detail  in  Section  10,  but  first  we 
provide  some  theoretical  foundations  for  this  wenk. 

Wcvhrauch  [4b]  presents  a  formal  system  oigamzed  about  a  theory/  metatheory 
distinction  in  which  non -monotonic  rules  (among  many  others)  can  be  expressed.  This 
system  also  makes  the  self  referential  natuie  of  such  idles  dear  by  allowing  explicit  self  - 
reference,  so  that  the  formal  system  has  a  name  for  itself,  and  can  draw  conclusions  about 
itself  in  the  throiy  of  itself  taken  as  an  object.  However,  the  system  is  its  own  model  of 
itself,  so  these  conclusions  can  change  the  referent  of  its  name  for  itself.  This  means  that 
new  derivations  can  affect  old  conclusions  drawn  from  previous  observations  of  the 
system's  state.  Much  work  remains  to  be  clone  along  these  lines,  one  detail  of  which  would 
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be  a  formal  comparison  of  Weyhrauch's  system  with  non  monotonic  logic. 

In  outlme,  our  analysis  of  non-monotonic  logic  will  proceed  as  follows.  We  first 
define  a  standard  language  of  discourse  including  the  non -monotonic  modality  M 
(  consistent").  I  he  semantics  of  the  language  is  based  on  models  constructed  from  fixed 
points  of  a  toimalizrd  non -monotonic  proof  operator.  Provability  in  this  system  is  then 
defined,  and  a  proof  of  completeness  foi  this  system  is  presented.  This  is  augmented  by  a 
proof  procediue  for  a  icstucted  class  of  theories  and  an  analysis  of  some  of  the  structure 
of  models  of  non  monotonic  theories. 


4  l.ingniMir  Preliminaries 

We  settle  on  a  language  l.  which  will  he  (he  language  of  all  theories  mentioned 
in  the  following.  1.  has  an  infinite  numbei  of  constant  letters,  variable  letters,  predicate 
letters,  and  propositional  constant  letters.  The  formation  rules  of  the  language  are  as 
follows : 


1  he  atomic  formulas  of  L  are  the  propositional  constant  letters  and  the  strings  of 
the  form  g(xj,...,xn)  for  predicate  lettei  g  and  vaiiables  or  constants  xj,  ...  ,  xn.  The 

formulas  of  /  are  either  atomic  formulas  oi,  foi  formulas  p,  q  and  variable  letter  x, 

stiings  of  the  form  Nip,  --p,  psq,  and  Vxp.  We  use  the  usual  abbreviations  of  pAq  for 
-Tp^’ql,  pvq  for  -qjoq,  .Ixp  for  -’Vx-'p,  and  abbreviate  -•M-'p  as  Lp.  A  statement  is  a 
formula  with  no  free  variables.  The  usual  rriiena  for  determining  free  variables  apply 
(  spp  In  addition,  a  variable  x  is  fiee  in  Mp  if  and  only  if  x  is  free  in  p. 

In  thi'-  paper,  the  letters  C,  D,  F.  and  F  will  be  used  as  syntactic  variables 

ranging  over  piopositmnal  constant  letters.  The  loiters  p,  q  and  r  will  be  used  for 

foimulac.  Implicit  quasi -quotation  is  used  throughout.  That  is,  if  p  and  q  arc  formulas, 
p  >q  is  the  foimula  obtained  by  concatenating  p,  the  implication  symbol,  and  q.  This 
notation  extends  to  handle  finite  sets  of  foimulas  in  the  following  way:  if  Q  is  a  finite  set 
of  foimulas,  and  Q  appears  in  a  quasi-quoted  context,  it  always  stands  for  the 
conjunction  of  its  elements.  For  example,  Q^p  means  the  formula  obtained  by  conjoining 
all  the  elements  of  Q  and  following  the  result  with  the  implication  symbol  and  p.  (If  Q  is 
empty,  it  stands  for  CvO.  Since  syntax  is  not  a  preoccupation  of  this  paper,  the 
ptesmtation  is  not  rigorous  in  specifying  the  number  of  arguments  of  predicate  letters, 
parenthesization,  etc. 

I  lie  inferential  system  used  defines  a  first-order  theory  to  be  a  set  of  axioms 
including  the  following  infinite  class  of  axioms: 


For  all  foimulas  ft,  q  and  i : 
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(6)  ( i)  |)^>Lq  ’pi 

(  n )  fp  j(  q  ->i  1 1  >1  (  p  ’q  jnlqai  j] 

(ui)  1  ’|>lr>f(.-.qv>plziql 
(iv)  V  x  p(  x  )  ’p(t) 

where  p(.x)  is  a  formula  and  t  is  a  constant  or  a  variable  free  for  x  in  p(x)  and  p( t ) 
denotes  the  result  of  substituting  t  for  every  fire  occurrence  of  x  in  p(x),  and 
(  v)  Vx[p=>q  I  a[prrV\q] 

if  p  is  a  fotmula  containing  no  free  occurrence  of  x.  (These  axioms  are  from  [27].) 
These  aie  the  logical  axioms.  All  other  axioms  are  called  pioper ,  or  non-logical  axioms. 
(This  terminology  is  misleading  for  axioms  which  are  logical  consequences  of  the  logical 
axioms,  but  we  will  ignore  this  inelegance.)  The  theory  with  no  proper  axioms  is  called 
the  predicate  calculus  (PC).  (Note  that  this  theory  also  contains  strings  containing  the 
lettei  M,  so  it  is  actually  not  strict  PC.)  The  sentential  calculus  (SC)  consists  of  axioms 
which  are  instances  of  (i),  (n)  and  (in)  only.  A  theory  consisting  only  of  the  sentential 
calculus  plus  a  finite  number  of  statements  is  called  a  statement  theory. 

In  this  paper,  the  letters  A  and  B  will  be  used  to  stand  for  theories. 


5.  Proof-Thenrelic  Operators 

The  monotonic  rules  of  mfetence  we  will  use  (also  from  [27])  are 

(7)  Modus  Ponens:  from  p  and  poq,  infer  q 

Generalization:  from  p,  infer  Vxp. 

If  S  is  a  set  of  formulas,  and  p  follows  from  S  and  the  axioms  of  A  by  the  rules  (7),  we 
sav  SP^p.  We  abbieviate  Ppp  by  T  alone.  We  define  Tli(S)  =  { p :  SPp}. 

The  particular  inference  rules  (7)  ate  not  very  important.  Later  in  the  paper, 
when  we  concent! ate  on  statement  thrones,  the  rule  of  generalization  will  be  dropped 
without  much  fanfare.  All  that  is  impoitant  is  that  the  operator  Th  have  the  following 
properties,  which  together  ate  called  monotonicity: 

(fl)  (i)AcTh(A) 

(  u )  If  A.  s_  g)  then  Th(  A )  £  I  h(  B) , 

and  the' property  (7)  of  idcmpetencc 

(9)  TMTh(A))  sTli(A). 


Clearly,  any  classical  inference  system  satisfies  these  conditions.  Condition  (9)  can  also  be 
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viewed  as  a  fixed  point  equation,  stating  dial  the  set  of  theorems  monotonically  deiivable 
from  a  theoiy  is  a  fixed  point  of  the  operator  which  computes  the  closure  of  a  set  of 
formulas  undei  the  monotonic  inference  rules.  A  well-known  property  of  the  monotonic 
inference  rules  is  that  Ih(A)  is  the  smallest  fixed  point  of  this  closing  process;  in  fact, 
that  lh(  A)  is  the  mtei section  of  all  S  such  that  A  c  S  and  Th(S)  =  S. 

In  oidei  to  deal  with  non  monotonic  logic,  we  need  a  new  inference  rule  like  this 
one  (which  we  will  take  back  immediately) : 

( 10)  "If  If  A  -p,  then  FA  Mp." 

I  hat  is,  if  a  formula’s  negation  is  not  derivable,  it  may  he  inferred  to  be  consistent.  As  it 
stands,  however,  this  rule  is  of  no  value  because  it  is  circular.  "Derivable"  means 
derivable  from  axioms  bv  infeience  rules",  so  we  cannot  define  an  inference  rule  in  terms 
of  deiivability  so  casually. 

Instead,  we  retain  the  definition  of  F  as  meaning  monotonic  derivability,  and 
define  the  operator  NM  as  follows:  for  any  first-order  theory  A  and  any  set  of  formulas 
S  E  L  (L,  recall,  is  the  entire  language),  let 

Ul)  NMa(S)  =Th(A  u  Asa(S)), 

where  A s A ( S ) ,  the  set  of  assumptions  from  S,  is  given  by 

( 12)  Asa(S)  =  {Mq :  q  e  L  and  'q  £  S}  -  Th(  A). 

Notice  that  theoiems  of  A  of  the  form  Mq  are  never  counted  as  assumptions.  NMA  takes  a 
set  S  and  produces  a  new  set  which  includes  Th(A)  but  also  includes  much  more: 
everything  provable  from  the  enlarged  set  of  axioms  and  assumptions  which  is  the 
oiigmal  theory  together  with  all  assumptions  not  ruled  out  by  S. 

We  would  like  to  define  1 11(A),  the  set  of  theorems  non-monotonically  derivable 
from  A,  by  analogy  with  the  monotomc  case  as 

(1-1)  'TH(A)  =  the  smallest  fixed  point  of  NMA." 

I  his  "definition"  tries  to  capture  the  idea  of  adding  the  non-monotomc  inference  rule  (10) 
to  a  first  order  theoiy  A.  I  Ins  is  plausible,  since  it  demands  a  set  such  that  all  of  its 
elements  may  be  ptoven  from  axioms  and  assumptions  not  wiped  out  by  the  proofs.  Such 
fixed  points  S  =  NMA(S)  might  be  depicted  as  in  Figure  1. 
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A 

As* (S) 

A 

L  -  S 

Th  (A) 

Mp  «- 

— ►  ->P 

NM. 

A 

(S) 

Figure  1:  I  hr  giaphic.il  conventions  air  iulrndcd  to  suggest  these  facts:  A  CTh(A), 
(Th(A)nAsA(S))  c  NMa(S),  Th(A)nAsA(S)  =  0,  (/.nS)nNMA(S)  =  0. 

Unfortunately,  thrie  is  in  general  no  appiopriate  fixed  point  of  NM*.  It  can  happen  that 
a  theory  has  no  fixed  point  tinder  the  operator  NMA.  Even  if  there  are  fixed  points, 
there  need  not  he  a  smallest  fixed  point. 

For  example,  considei  the  theory  T1  obtained  as 

(14)  T1  =  PC  11  {  MDa-C  }, 

wheie  C  and  D  are  propositional  constants.  NM|j  has  two  fixed  points,  which  can  be 
callprl  Fi  and  F2.  FI  contains  -C  but  not  d),  and  F2  contains  -'D  but  not  ->G.  Since  -•D  is 
not  in  FI,  Ml)  is  in  FJ,  and  so  ->0  is  in  H.  Similarly,  the  presence  of  -,D  in  F2  keeps  ->C 
out  and  MG  in  F2.  The  problem  is  that  neither  FlnF?.  nor  FluF2  is  a  fixed  point  of 
NM-|-j.  Since  nelthet  --C  nor  -d)  is  in  FlnF2,  MG  and  MD  are  both  in  NM-|-j( FlnF2) ,  so 
’’C  and  -D  are  in  N M-j-j ( FlnF2) ,  so  FlnF?.  *  NM  |  j(  FlnF2).  Similarly,  both  -■C  and  --D 
are  in  NM-pj(  FluF2) ,  so  applying  NM  |  j  to  the  union  results  in  a  smaller  set.  So  in  this 
case  there  is  no  natural  status  for  C  and  d). 

An  example  of  a  theory  with  no  fixed  point  of  the  corresponding  operator  is  the 
theory  T2  obtained  as 

(15)  T2  =  PC  u  {  MC^C  }. 

In  this  case,  NMj-j  has  no  fixed  point,  since  alternate  applications  of  the  operator  to  any 
set  produce  new  sets  in  which  either  both  MG  and  --C  exist  or  neither  exist. 


'‘'A--' 
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Iherefore,  wr  must  accept  a  somewhat  less  elegant  definition  of  TH.  Let  us 
define  TH  as  follows: 

(if-)  ni( a)  =  n(Ui u {S:  nma(s)  =  s}). 

I  Hat  is,  the  set  of  provable  formulas  is  the  intersection  of  all  fixed  points  of  NM^,  or  the 
entne  language  if  theie  are  no  fixed  points.  We  will  use  the  abbreviation  AKp  to  indicate 
that  p  (  I  II ( A ) .  With  this  definition,  neither  NIC  nor  Ml)  is  a  theorem  of  T1  in  (14), 
but  MCvMD  is.  In  the  following,  we  will  abbieviate  {S.  NMA(S)  =  S}  as  FP(A),  and 
(  somewhat  abusing  the  teims)  call  the  elements  of  this  set  fixed  points  of  the  theory  A. 

Ibis  definition  of  the  provable  statements  is  quite  similar  in  some  respects  to  the 
definition  of  compatibility-restricted  entailment  given  by  Rrscher  [361.  In  that  system,  a 
set  S  of  foimulas  is  said  to  C.R-entail  a  formula  p  if  p  follows  in  the  standard  fashion 
from  each  of  one  or  more  "preferred"  maximal  consistent  subsets  of  S.  In  the  present  case, 
we  obtain  the  preferred  subsets  of  formulas  as  fixed  points  of  the  opeiator  NM^  (the 
"compatible  subsets"),  but  in  contrast  to  normal  deducibility  where  the  empty  set  always 
suffices,  there  need  not  be  any  such  subsets.  This  case  produces  the  entire  language  as  the 
set  of  provable  formulas  by  vacuous  fulfillment  of  the  condition  of  detiv ability. 

One  unusual  consequence  of  this  definition  of  provability  is  that  the  deduction 
theorem  does  not  hold  for  non  monotonic  logic.  For  example,  while  {  C  }  b  MLC,  it  is 
not  tine  that  b  C^MI.C.  This  failure  of  the  deduction  theorem  is  to  be  expected, 
howevei ,  since  the  non-monotonic  pi ov ability  of  a  formula  depends  on  the  completeness 
of  t tie  set  of  hypotheses,  that  is,  on  the  fact  that  no  other  axioms  are  available.  The 
deduction  theorem,  however,  would  if  valid  produce  implications  valid  no  matter  what 
other  axioms  were  added  to  the  system,  even  if  these  axioms  would  invalidate  the 
completeness  condition  used  in  the  derivation  of  the  implication.  One  should  note  that 
although  the  deduction  theorem  does  not  hold  in  general  in  non-monotonic  logic,  there  arc 
many  particular  cases  in  which  it  does  hold.  For  instance,  if  some  conclusion  follows 
classically  from  some  hypotheses,  then  the  expected  implication  will  also  hold.  In 
addition,  not  all  properly  non-monotonic  theories  ate  such  that  the  deduction  theorem 
fails.  It  is  an  interesting  open  problem  to  characterize  the  precise  cases  in  which  the 
deduction  theorem  is  valid  in  non  monotonic  thrones. 

So  far,  we  have  defined  "provability"  without  defining  "proof".  For  a  formula 
to  be  provable  in  a  theory,  it  must  have  a  standard  proof  from  axioms  and  assumptions 
in  each  fixed  point  of  the  theory,  and,  as  yet,  we  have  no  way  of  enumerating  fixed 
points  oi  even  of  desmblng  one.  It  is  woith  note  that  when  a  theory  has  more  than  one 
fixed  point,  the  fixed  points  are  inaccessible  in  the  sense  that  the  sequence  'lh(A), 
NNI  A(  Th(  A ) ) ,  NM  A(  NMA(  Th(  A) ) ) ,  ...  does  not  converge  to  a  fixed  point.  We  have  a 
proof,  which  we  do  not  present  here,  that  if  NMA  has  exactly  one  fixed  point,  then  the 
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fixed  point  is  the  limit  of  successive  applications  of  NM^  to  the  sequence  of  sets  starting; 
with  A.  We  will  eventually  attend  to  defining  nonmonotonic  proof,  but  first  we  turn  our 
attention  to  the  topic  of  semantics. 

fi.  Model  Tlirniy 

The  semantics  of  non  monotonic  logic  is  built  on  the  notion  of  model,  just  like 
the  semantics  of  classical  logic.  In  fact,  the  definition  of  model  for  a  non  monotonic 
theoiy  depends  directly  on  the  usual  definition. 

An  inter  pi  elation  V  of  formulas  over  a  language  L  is  a  pair  <X,  U>,  where  X  is 
a  nonempty  set,  and  II  is  a  function  which  associates  relations  and  values  over  the  domain 
X  with  each  predicate,  variable,  constant  and  piopositional  constant  letter  in  the  usual 
fashion.  That  is,  fot  each  n-aiv  pmlicate  letter  P,  LI(P)  5  Xn;  for  each  variable  or 
constant  x,  U(x)  c  X;  and  for  each  propositional  constant  letter  C,  U(C)  c  {0,  1}. 
Using  this  mapping  function  U  we  define  the  value  V(p)  of  a  formula  p  in  the 
intei pretat ion  V  to  be  an  element  of  {0,  1}  satisfying  the  following  conditions:  For  an 
atomic  foimula  p(xj,  ...,  xn),  the  value  is  1  if  <ll(xj),  ...,  U(xn)>  €  U(p),  and  is  0 
otherwise.  V(  >p)  =  1  jf  V(p)  =  0,  and  is  0  otherwise.  V( p  =>q )  =  1  if  either  V ( p)  =  0  or 
V(q)  =  1,  and  is  0  otherwise.  V(Vxp)  =  1  jf  for  all  y  €  X,  V'(p)  =  1,  where  V'  =  <X 
tv/  x  M I  > ,  where  C  y  /  x]U  is  the  mapping  denvrd  from  U  by  changing  its  value  at  the 
point  x  to  the  value  v.  V(Vxp)  =  0  otherwise.  If  V(p)  =  1,  we  say  that  V  satisfies  p,  and 
write  Vbp. 

A  monotonic  model  of  a  set  of  foimtilas  S  £  L  is  an  inlet pretation  V  which 
satisfies  each  formula  in  S,  that  is,  V ( p )  =  1  foi  each  formula  p  c  S.  A  non-monotonic 
model  of  a  theory  A  is  a  pair  <V,  S>,  where  V  is  a  monotonic  model  of  S,  and  S  e  FP(  A). 
When  the  context  makes  the  intended  meaning  drar,  we  will  use  the  term  model  of  A  to 
mean  either  a  non  monotonic  model,  a  monotonic  model,  or  an  element  of  FP(A)  for  the 
theory  A. 

Although  unorthodox,  this  definition  ptovides  a  meaning  for  formulas  Mp 
which  reflects  the  proof -theoretic  properly  that  "p  is  consistent  with  what  is  believed". 
This  notion  is  made  piecise  by  including  in  the  model  a  set  of  "current  assumptions" 
(narnelv,  As^(S)).  A  model  for  a  theory  must  assign  1  to  all  of  those  assumptions,  so  the 
effect  is  that  Mp  is  assigned  1  in  a  model  if  -p  is  not  derivable  and  •’Mp  is  not  derivable 
fiom  the  ament  assumptions  and  the  oi tr mat  theoiy,  that  is,  if  p  is  consistent  with  what 
is  "believed"  m  the  model,  llnfoitunately,  Mp  mav  be  assigned  1  in  some  model  even 
when  ’p  is  derivable  (for  example,  when  no  axiom  mentions  Mp  at  all).  This  indicates 
that  the  logic  is  too  weak. 
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We  view  tbe  weakness  of  this  semantics  as  (hr  worst  defect  of  our  logic.  We 
thmt.  we  can  improve  a,  but  it  appears  (hat  (hr  semantics  of  non -monotonic  systems  will 
always  he  somewhat  unoithodox.  The  problem  n  the  failure  of  a  kind  of  locality  in 
semantic  definitions.  In  conventional  logits,  llir  meaning  of  a  composite  expression  can 
always  be  defined  in  trims  of  the  meanings  of  its  parts,  even  if  these  meanings  aie  infinite 
tilings  like  functions  on  sets  of  possible  woilds.  In  non-monotonic  logic,  this  is  impossible. 
I  he  meaning  of  Mp  can  nevei  he  purely  a  function  of  the  meaning  of  p,  because  it 
depends  on  the  available  axioms  as  well.  This  "holistic"  property  seems  inescapable.  The 
best  we  can  do  is  to  tiy  to  express  tins  dependence  semantically,  in  terms  of  models  of  p 
plus  tbe  axioms.  In  the  semantics  just  presented,  this  is  not  achieved,  but  we  have  hope 
that  it  can  be  achieved  (or  a  slightly  st longer  logic. 

With  this  definition  of  model,  we  can  justify  the  definition  of  provability. 
Theorem  /.  (Soundness)  If  ATp,  then  VTp  for  all  models  <V,  S>  of  A. 

Proof:  Assume  Ahp.  If  there  are  no  models  of  A,  the  theorem  follows  trivially. 
Otherwise,  p  is  a  member  of  eveiy  fixed  point  of  A.  But  since  every  model  of  A  is  a 
monotonic  model  of  a  fixed  point  of  A,  every  model  assigns  1  to  p.  I 

Theorem  2.  (Completeness)  If  Vhp  for  all  models  <V,  S>  of  A,  then  Ahp. 

Proof :  Assume  that  it  is  not  true  that  At>  Thus  there  is  a  fixed  point  S  of  NMA 
which  does  not  contain  p.  Now  Th(S)  =  S  by  idempotence,  so  Sf/p.  But  the  predicate 
calculus  is  complete,  so  some  monotonic  model  V  of  S  has  V(p)  =  0.  8 

It  is  not  suipiising  that  we  have  completeness,  since  the  definition  of  truth 
makes  reference  to  provability.  The  proof  was  for  first-order  theories,  but  it  can  easily  be 
generalized  to  anv  complete  foimal  logic.  For  example,  if  we  take  care  not  to  confuse  M 
with  the  S5  operatoi  "possibly",  wc  can  easily  get  a  complete  non-monotonic  extension  of 
SS.  However,  none  of  these  observations  are  very  interesting  unless  we  have  some 
assurance  that  provability  is  decidable.  We  will  shortly  present  a  proof  procedure  for 
non- monotonic  statement  theories. 


7.  Fixed  Points  nf  Theories 

I  Ins  section  will  ti  v  to  analyze  the  structure  of  fixed  points  for  non-monotonic 
theones.  We  investigate  the  number  of  fixed  points  of  theories,  and  their  relation  to  the 
provable  statements. 

Non  mnnoton.c  theories  may  have  varying  numbers  of  fixed  points.  Classically 
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inconsistent  theones  have  |ttsf  one  fixed  |mmi  (die  cntnc  language  L)  and  thus  no 
models,  the  tlieoty  12  in  (IS)  also  has  no  models  due  to  the  lack  of  a  fixed  point, 
theories  foinnilajed  in  stnctly  classical  language  have  exactly  one  fixed  point,  as  does  the 
theory 

U7)  T3  =  PC  u  {  MC^C  ). 

Some  theories  have  several  fixed  points,  e.g.  T1  in  (14).  It  is  also  possible  for  a  theory  to 
have  an  infinite  number  of  fixed  points.  This  is  exemplified  (we  assume  equality  and  an 
infinite  domain  of  unequal  constants)  by 

HA)  T4  =  PC  U  {  Vx[Mp( x ) n[p( x ) A Vy( x^y 3->p( y ) 33]  }. 

(■.veil  in  theoiies  having  only  one  fixed  point,  the  -non-monotonically  provable 
statements  need  not  coincide  with  the  classically  provable  statements.  Theory  T3  above  is 
an  example,  for  C  r  111(13),  hut  C,  4  l'h(T3).  Some  statements  will  be  provable  in 
theoi ies"  with  multiple  iixed  points,  hut  will  have  different  proofs  in  each  fixed  point.  For 
example,  MCvMD  <=  111(11),  and  ,l\Mp(x)  e  T'||( T'4 ) . 

1  he  classical  results  concerning  truth  and  provability  for  logical  languages  are 
that,  foi  a  given  tlieoty  A,  a  formula  is  valid  in  A  (true  in  all  models  of  A)  if  and  only 
if  it  is  provable  in  A,  and  that  the  theory  has  a  model  if  and  only  if  it  is  consistent 
(cannot  he  used  to  derive  a  conti ad icticm ) .  In  nonmonotonic  logic,  somewhat  different 
circumstances  obtain.  As  llieorems  1  and  2  have  shown,  validity  in  a  theory  remains 
equivalent  to  provability.  However,  from  the  definition  of  models  of  non-monotonic 
theones,  it  follows  that  a  nonmonotonic  tlieoty  A  has  a  model  only  if  the  operator  NM^ 
has  a  classically  consistent  fixed  point.  Non -monotontc  theones  can  lack  fixed  points  (e.g. 
the  theory  II),  hut  we  have  defined  such  theories  to  be  inconsistent. 

I  lie  basic  sti tictui e  theorem  states  that  all  fixed  points  of  a  non-monotonic 
fheoiv  A  aie  (set  inclusion  - )  minimal  fixed  points. 

Theorem  3.  If  Sj,  Sj  r  FP(A)  and  Sj  c;  St,  then  Sj  =  Sj. 

Pioof:  If  Sj  So,  then  As^(Sp)  G  As^(Sj),  so  by  the  monotonicity  of  Tb, 
NMa(Sp)  -  NM^(Sj).  But  since  Sj  and  So  are  fixed  points  of  this  operator,  £  Sj,  so 
S,  =  S2.  I 

I  his  result  suggests  that  strict  set -theoretic  minimality  is  not  a  particularly  interesting 
distinction  among  fixed  points.  In  the  following  sections  we  will  make  steps  towards  more 
interesting  classifications,  hut  without  a  fully  satisfactoiy  solution.  Important  applications 
of  this  theorem  ate  the  following  two  corollaries. 

Corollary  4.  If  /  is  a  fixed  point  of  A,  then  it  is  the  only  fixed  point  of  A. 
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Proof :  If  S  '  1  P(  A) ,  thou  S  ?-  L,  so  S  =  /.  by  Theorem  3.  B 
Note  that  if  l  is  a  fixed  point  of  A,  then  A  is  classically  inconsistent,  that  is,  Th(A)  =  L. 
Corollary  *>.  If  p(  np  e  TH(  A ) ,  then  TII(A)  =  I.. 

Proof:  If  A  has  no  fixed  points,  the  theorem  follows  by  definition.  If  both  p  and  ->p 
are  members  of  a  fixed  point  S  of  A,  then  since  fixed  points  are  closed  under  monotonic 
deduction,  S  =  L.  But  then  FP(A)  =  {/.},  so  Tll(  A )  -  L.  fl 

With  these  results,  we  can  study  the  notion  dual  to  provability  in  non-monotonic 
theones.  We  say  that  a  formula  p  is  arguable  from  A  if  p  e  UFP(A),  that  is,  if  some 
fixed  point  of  A  contains  p.  Clearly,  all  provable  formulas  are  arguable.  Our  next 
theoiem  shows  that  in  consistent  theories,  provability  and  arguability  are  almost  dual 
notions. 

Theorem  6.  If  A  is  consistent  and  p  is  piovahlc  in  A,  then  ->p  is  not  arguable. 

Proof:  If  p  is  provable  in  a  consistent  theory  A,  then  any  S  e  FP(A)  containing  ->p 
would  be  inconsistent,  which  is  impossible  by  Corollary  4.  D 

Unfortunately,  the  converse  of  this  theorem  is  not  true.  For  example,  in  the  theory  with 
no  proper  axioms,  ->C  is  not  arguable,  but  C  is  not  provable.  We  will  term  the  notion 
dual  to  provability  conccivability,  so  that  C  is  conceivable  if  it  is  not  provably  false.  Thus 
all  arguable  fotmulas  aie  conceivable,  but  not  vice  vena.  We  say  doubtless  p  if  and  only  if 
-p  is  not  arguable.  In  PC,  C  is  doubtless  yet  not  arguable,  and  in  the  theory 
( 19)  TS  =  PC  u  {  MC:>C,  IVhC^C  } 

C  is  arguable  yet  not  doubtless.  Figure  2  summarizes  these  classifications. 
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Figure  2.  Diagram  of  four  classifications  of  formulas.  Lach  line  connects  a  set  of  formulas 
wiih  a  superset.  Incomparable  sets  arc  not  connected  in  this  way. 

li  is  woithv  of  note  that  the  provable  and  arguable  statements  of  a  consistent 
theory  cannot  be  classified  as  the  monotonic  theorems  of  the  theory  augmented  by  some  set 
of  assumptions.  I  hat  is,  the  set  of  arguable  statements  may  be  inconsistent  yet  not  sum  to 
the  entire  language  and  the  set  of  ptovable  statements  may  involve  assumptions  that 
vaiy  from  fixed  point  to  fixed  point,  as  in  the  theory  T2  above,  where  neither  the 
assumption  Mf',  not  the  assumption  Ml)  is  present  in  both  fixed  points. 

Anotbei  natural  classification  is  that  of  "decision".  We  say  that  p  is  decided  by  a 
consistent  theory  A  it  and  only  if  for  all  S  <-  F P ( A ) ,  either  p  €  S  or  ->p  e  S.  The  dual  to 
this  notion  is  just  its  negation.  In  this  case  we  say  that  A  is  ambivalent  about  p  if  p  is  not 
decided  by  A. 

Corollary  7.  If  p  is  doubtless  yet  decided  by  A,  p  is  provable. 

Proof:  for  each  S  €  FP(A),  either  p  c  S  or  ->p  e  S;  yet  ->p  $  S,  so  p  €  S.  I 


8.  The  Evolution  of  Theories 

We  now  turn  to  analyzing  inter-theory  relationships.  These  are  important  in 
desciiblng  the  effects  of  incremental  changes  tn  the  set  of  axioms,  and  this  is  the  task  of 
piactical  systems  like  the  IMS  Ifi],  which  has  the  task  of  maintaining  a  description  of  a 
model  of  a  changing  set  of  axioms.  As  we  shall  see,  there  are  many  unusual  phenomena 
which  occur  when  theories  change.  The  most  sinking  result  shows  that  the  analogue  of 
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t lie  compactness  tliroirm  nf  classical  model  theory  does  not  hold  for  non -monotomc 
thcoiiesr  This  has  impoitant  repercussions  on  the  methods  useful  in  constructing  "models" 
of  theories  increment  ally. 

Thrown  S.  Theie  exists  a  consistent  theory  with  an  inconsistent  subtheory. 

Proof:  Consider  the  consistent  theory 

(20)  T6  =  PC  u  {  MC^C,  -C  }. 

I  he  subtheory  PC  U  {  MC~>^C  )  is  inconsistent.  B 

Note,  however,  that  the  theoiy  T6  in  (20)  has  as  a  thesis  the  formula  -■MC,  which  makes 
it  quite  diffeient  than  some  previously  considered  theories.  We  will  comment  further  on 
this  type  of  theory  in  Section  11. 

In  many  cases,  the  changes  in  fixed  points  induced  by  changes  in  theories  is  less 
drastic  than  those  appairnt  in  the  ptevious  theorem.  The  simplest  cases  are  as  follows. 

Thrown  9.  If  A  is  consistent,  and  p  is  arguable  in  A,  then  A*  =  Au{p)  is  consistent,  and 
FP(  A’)nFP(  A)  t-  0. 

Proof :  Since  p  is  arguable,  there  is  some  S  e  FP(A)  such  that  p  £  S.  But  clearly,  S  is 
then  also  a  fixed  point  of  NM^i.  B 

Unfortunately,  this  theorem  cannot  be  stiengthened  to  conclude  that  FP(A')  is  contained 
in  FP(A),  since  in  I  he  theory 

(21)  T7  =  PC  ii  {  MCa-D,  Mlla-C,  OE  } 

there  are  two  fixed  points,  call  them  U  and  F2,  with  -•C  6  FI,  E  €  FI  and  -,D  €  F2, 
F.  F2.  Extending  this  theory  by  adding  the  axiom  E  produces  a  theory  also  with  two 
fixed  points,  one  of  which  is  FI,  but  the  other  fixed  point  F3  differs  from  F2  in  that 
E  «=  F3  and  IVhE  €  F3. 

Thrown  10.  If  A  and  A'  =  Au{p}  are  consistent  and  FP(  A)nFP(  A')  ^  0,  then  p  is 
arguable  in  A. 

Proof:  Since  p  c  A',  p  €  S  for  every  S  F  FP(A').  Thus  p  e  S  for  some  S  €  FP(A).  I 

Thrown  II.  If  A  and  A'  =  Au{p)  are  consistent,  then  p  is  provable  in  A  if  and  only  if 
FP(A’)  =  FPU). 

Proof:  If  p  is  provable  in  A,  p  t  S  for  every  S  €  FP(A),  so  each  member  of  FP(A)  is 
also  a  member  of  FP(A').  If  FP(A)  =  FP(A'),  then  since  p  €  S  for  each  S  €  FP(A'), 
p  e  S  foi  each  S  f  FP(  A) ,  so  p  is  provable  in  A.  B 
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I  lif  impoit  of  these  tlmrumis  is  that  if  a  new  axiom  is  already  implicit  in  the 
cm  rent  axioms,  either  no  change  of  fixed  point  is  necessary,  01  a  simple  shift  to  a 
different  fixed  point  of  the  pievious  axioms  is  allowable.  When  considering  changes 
which  delete  axioms  from  theories,  the  basic  problem  is  the  non  compactness  result 
mentioned  above.  Other  interesting  questions  ate  of  the  foim  "how  few  axioms  must  be 
added  01  lemoved  to  temove  p".  Answers  to  these  questions  will  jn  general  depend  on  the 
specific  theory  in  question. 

Anothei  important  phenomenon  is  the  "hierarchy  of  assumptions"  t63,  in  which 
some  non  monotonic  choices  depend  on  others.  This  manifests  itself  in  terms  of  fixed 
points  as  the  addition  ol  new  axioms  incteasing  the  number  of  fixed  points  of  the  theory. 
Foi  example,  adding  the  axiom  F.  to  the  theory 
(2.2)  TO  =  PC  u  j  [FaMCJ^L),  [FaMDI^C  } 

increases  the  numbei  of  fixed  points  fiom  one  to  two.  In  this  case,  F  can  be  interpreted  as 
the  reason  for  choosing  between  -•C  and  •’D.  Since  F.  itself  might  have  been  an 
assumption,  them  might  theiefore  he  a  hierarchical  structure  of  assumptions  in  each  fixed 
point. 


I  o  get  a  global  view  of  theory  evolution,  we  consider  the  set  of  all  consistent 
theones  containing  a  consistent  theory  A  as  a  subtheory.  For  a  formula  p,  we  can 
consider  r he  evolution  of  the  piopcrties  of  p  of  being  arguable,  provable,  or  decided  over 
sequences  0f  extensions  of  the  theory  A.  The  evolution  of  arguability  is  mainly  a  question 
of  control  structures;  this  is  the  point  of  the  encoding  of  control  primitives  in  non¬ 
monotonic  dependency  relationships  given  by  tloyle  C61.  We  have  at  present  no  way  of 
describing  the  evolution  of  decision.  However,  analysis  of  the  relationships  between  the 
thrones  and  their  extensions  will  shed  light  on  how  our  semantics  for  Nip  matches  the 
intuitive  notion  of  "p  can  be  added  consistently  to  the  theory". 

We  say  that  p  is  assumable  in  a  consistent  theory  A  if  the  theory  Au{p)  is  also 
consistent.  We  name  the  dual  notion  bv  saying  that  p  is  uncontrovcrsial  in  a  theory  if  -p 
is  not  assumable  in  the  theory.  The  matching  of  the  semantics  of  non -monotonic  logic 
with  this  more  standard  notion  of  consistency  will  be  apparent  upon  examining  the 
correlation  between  assumability  of  p  and  the  arguability  of  Mp  in  a  theory,  since  this 
latter  condition  would  seem  to  say  there  is  a  coherent  interpretation  of  the  axioms  in 
which  p  is  consistent.  Our  logic  is  weak,  however,  and  so  this  correlation  is  weak.  As  an 
appioximafion,  we  note  that  Mp  is  arguable  if  p  is  arguable,  and  so  instead  attempt  to 
correlate  arguability  of  p  with  assumability  of  p.  I  bis  correlation  is  as  follows,  fly 
Theorem  9  the  assumable  formulas  includes  the  arguable  foimulas,  but  not  vice  versa  since 
C  is  assumable  but  not  arguable  in  PC.  The  assumable  formulas  are  incomparable  with 
the  conceivable  formulas,  since  C  is  conceivable  but  not  assumable  in 
( 23)  T9  =  PC  u  {  Cat  DAtMn^D]]  }, 

and  ->C  is  assumable  but  not  conceivable  in  the  theory  T3  of  (17).  Also,  the  assumable 
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formulas  air  incomparable  with  the  uucontiovrrsial  formulas,  since  C  is  assumable  but  not 
uncontioversial  in  PC,  and  C  is  uncontioversial  but  not  assumable  in 
(24)  I  10  =  PC  U  {  C:»CDA(IVIl)n,l3]J,  <nfF.A(M[.r>,KJ]  }. 

We  specify  another  classification  by  saying  that  a  foimula  p  is  safe  in  a 
consistent  theory  A  if  and  only  if  p  e  TH(A')  for  all  consistent  A'  such  that  A  £  A',  and 
that  p  is  forseeable  if  and  only  if  ^p  is  not  safe.  Let  Safe(A)  =  {p:  p  is  safe  in  A}.  We 
then  can  cliai  acterize  the  set  Safe(A)  as  follows. 

Theorem  12.  If  A  is  consistent,  then  Sale(A)  is  the  least  set  such  that  the  following  three 
conditions  hold: 

( i)  A  G  Safe(  A) 

( 1 1 )  lh(Safe(A))  =  Safe(A) 

(in)  If  p  €  Safe(  A),  then  Mp  e  Safc(  A). 

Proof:  The  first  two  cases  air  collect  because  all  formulas  classically  deducible  from  safe 
fornuilas  (in  paiticulai  the  axioms)  will  remain  classically  deducible  when  the  set  of 
axioms  is  enlarged.  The  case  of  interest  is  (in),  which  declares  that  "covered" 
assumptions  are  safe.  I  hat  is,  if  p  e  Safe(A),  then  -’p  cannot  be  a  member  of  any 
consistent  extension  of  A,  so  Mp  will  be  a  member  of  eveiy  consistent  extension;  thus  Mp 
is  safe.  I 


It  is  clear  that  all  safe  formulas  are  holh  assumable  and  uncontioversial,  and 
that  these  inclusions  are  proper.  Elementary  considerations  show  further  that  the 
forseeable  formulas  include  the  assumable  and  uncontioversial  formulas,  but  again,  not 
vice  versa.  Also,  the  provable  formulas  properly  include  the  safe  formulas  with  theory  13 
in  ( 17)  as  the  example,  and  the  forseeable  formulas  properly  include  the  conceivable 
formulas  via  the  same  example. 

A  weakened  version  of  assumability  is  pioduced  by  saying  that  p  is  realizable  in 
a  consistent  theory  A  if  theie  is  some  consistent  theory  A'  such  that  A  s  A'  and  p  €  A'. 
We  also  say  that  p  is  undeniable  if  and  only  if  -p  is  not  realizable.  C.learly,  the  realizable 
fornuilas  include  the  assumable  formulas,  but  the  converse  docs  not  hold  as  MC^C  is  not 
assumable  in  PC  but  is  an  axiom  of  the  consistent  theory  16  in  (20).  The  forseeable 
fornuilas  obviously  include  the  realizable  formulas,  but  not  vice  versa  since  G  is  forseeable 
but  not  icalizable  in  the  theoiy  T9  of  (23).  Also,  t he  realizable  formulas  are 
incomparable  with  the  conceivable  formulas,  since  C  is  conceivable  but  not  realizable  in 
T9  of  (23),  and  -C  is  icalizable  but  not  conceivable  in  T3  of  (17).  The  example  of  T10 
in  (74)  provides  an  example  of  what  following  Kripke  might  be  called  the  paradoxical 
formulas  of  a  theoiy,  formulas  (in  this  case  C)  such  that  neithei  they  nor  their  negations 
are  realizable.  The  example  of  T9  in  (2.3)  provides  an  example  of  what  might  be  called 
the  intrinsic  formulas  of  a  theory,  fornuilas  (in  this  case  -C)  which  are  realizable  and 


v'V 

TCa- 


✓ 


23 


undeniable. 

Figme  3  summai  i7es  all  these  observations. 


Fignip  3.  Diagram  of  the  classifications  of  formulas.  Fach  line  connects  a  set  of  formulas 
with  a  superset. 

these  results  illustrate  the  distinction  between  arguability  and  assumability,  that 
ai Pliability  does  not  completely  capture  the  notion  of  assumability.  I  his  is  probably  to  be 
expected  fiom  the  Codel  Tarski  results  on  the  indescribability  of  consistency  within 
consistent  theoties.  It  would  be  interesting  to  see  a  more  careful  analysis  of  this  situation. 
One  goal  of  such  an  analysis  might  be  to  connect  the  logic  of  incomplete  information 
implicit  in  nonmonotonic  logic  to  other  logics  of  incomplete  information,  such  as  the  S4 
interpretation  of  the  intuitmmstic  predicate  calculus  Cl 3 ,  18],  Kripke's  theory  of  truth  [19; 
cf.  22,  44],  and  l.ipski's  theory  of  incomplete  models  [20;  cf.  37,  4S].  I  he  S4 
Interpretation  of  IPC.  tues  to  describe  tbe  gradual  accumulation  of  mathematical  truths, 
and  seems  closely  related  to  out  notion  of  safety.  Kripke's  theory  of  truth  has  strong 
similarities  to  thr  current  theory,  for  it  develops  models  for  the  truth  of  self-referential 
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nnd  tlieoiy  iclriinii.il  statements  winch  air  fixed  points  of  a  ccitam  o|)eratot  on  partially 
defined  r i nr li  pirdiratre.  Since  the  acceptable  models  of  truth  are  restucted  to  be  fixed 
points,  of  this  opeiafor,  iheie  can  he  ncvei -decided  paradoxical  statements.  The  logic  of 
(he  natural  notions  of  possibility  and  necessity  thus  are  not  dual,  but  instead  form  a 
diamond  lelalinnship  similar  to  the  case  for  non-monotonic  assumabtltty  and  safety, 
l.ipski's  theoty  of  incomplete  models  Is  considerably  simpler  and  sponger  than  either 
Knpkr's  throiy  ot  non  monotonic  logic,  for  his  incomplete  models  can  be  constructed  from 
any  partial  extensions  of  the  predicates  of  the  language,  thus  producing  a  certain 
completeness  in  rhr  set  of  possible  models.  This  logic  is  particularly  interesting  in  that  it 
allows  f 01  the  truth  value  of  formulas  to  change  arbitrarily  often  upon  successive 
extensions  of  models. 

In  the  above  we  have  been  concerned  only  with  ways  of  deset dung  the  evolution 
of  thrones  upon  the  addition  of  new  axioms.  One  might  also  define  descriptor  for  the 
case  of  removing  axioms,  or  foi  the  past  history  of  piovability.  For  example,  assuming 
that  all  subtheories  of  A  are  consistent,  wr  might  sav  that  p  is  untested  if  p  is  conceivable 
in  every  subtheniy  of  A.  (Cf.  113,  p.  US])  Arc  there  other  interesting  descriptors  of  this 
kind''  ll  so,  what  ate  their  properties?  We  have  not  investigated  these  questions,  but 
suspect  they  may  be  fruitful. 


0.  A  Proof  Procedure  for  Non-Mnuotoiiic  .Statement  Theories 

In  Ibis  section,  we  demonstrate  a  proof  procedure  for  the  non-monotonic 
statement  logic.  I  his  piocetlure  is  based  on  the  semantic  tableau  method  for  the  oidinary 
sentential  calculus.  1 1J  In  this  method,  a  systematic  attempt  is  made  to  find  a  falsifying 
inret pretation  foi  a  foimnla  nuclei  test.  The  foimula  is  labeled  "false"  or  ”0",  and 
semantic  rules  guide  futthet  labeling  in  an  obvious  way.  For  example,  to  show 

1C  n  D]  3[T,v  03, 
stait  by  labeling  the  foi nuila  false: 


1C  3  HI  :>  t-C  v  m 
0 

For  it  to  be  false,  Its  antecedent  must  be  tine  and  its  consequent  false: 


(C  3  HI  d  f^C  v  m 

1  0  0 

and  similarly  foi  disjunction  and  negation.  In  order  to  |iroceed  further,  the  tableau  must 
split  into  two  cases  to  handle  the  embedded  irr>|dtcation: 
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i .  ir  3  oh  i-c  v  m 

01  0  m  o 

n.  in  ni  r>  i-c  v  m 

111  0  01  0  0 

In  case  I.,  C  is  labeled  both  1  and  0.  In  case  II.,  D  is  labeled  both  1  and  0.  Thus  there  is 
no  falsifying  model,  and  the  fomuila  is  valid. 

On  the  othei  hand,  consider  the  tableau  for  [C  V  D]  a  tC  A  DD: 

(Z5>  1C  v  Oh  1C  a  01 
1  0  0 

ic  v  m  in  e  m 

11  0  0 

IC  V  ill  o  (C  a  01  CLOSE0 
11  0  0  0 

(C  V  01  :>  (C  A  0)  OPEN 

110  0  10  0 

1C  v  0)  d  1C  A  0] 

110  0 

IC  v  01  :>  IC  a  0)  OPEN 
0  1  1  0  0  0  1 

(C  v  01  d  IC  a  0]  CLOSED 

111  0  100 

This  tableau  has  been  split  twice,  for  a  total  of  four  branches.  Two  branches  are  closed  as 
before,  that  is,  some  foimula  is  labeled  both  true  (1)  and  false  (0).  But  two  are  open, 
that  is,. there  is  an  exhaustive  consistent  labeling  of  fotmulas.  This  means  that  there  are 
two  falsifying  models,  so  the  formula  is  not  valid.  (Notice  that  we  could  have  been  more 
c level  in  labeling  the  lines  of  this  tablrau.  In  the  second  line,  for  instance,  we  could  have 
labeled  both  G's  at  once,  forcing  the  D's  to  be  labeled  0,  and  arriving  at  an  open  branch 
Immediately.) 

We  will  extend  this  procedure  to  handle  non  monotonic  statement  theories. 
Without  going  into  details,  we  assume  an  implementation  of  the  algorithm  just  alluded  to, 
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winch  takes  ,t  goal  and  geneiatcs  the  complctf’  tableau  for  it.  (E.g.,  the  goal  of  (2S)  is 
IGvDl  'l ( .aD  I.)  A  tableau  lias  several  branches,  each  a  consistent  labeling  of 
subformulas  if  one  exists  (when  the  branch  is  open),  else  a  partial  labeling  (when  it  is 
closed).  I  he  tableau  is  the  icsult  of  applying  all  tides  to  the  goal.  Two  tableaux  ate 
equal  it  and  only  if  they  have  the  same  goal.  The  tableau  of  a  formula  is  obviously 

N 

computable,  since  the  number  of  branches  is  no  gieatei  than  2  ,  where  N  is  the  number 
of  snbfoi  rnutns  of  its  goal. 

We  state  without  proof  the  following  properties  of  the  tableau  method: 

I  hr  procedure  is  complete  in  the  sense  that  a  formula  is  provable  if  and  only  if 
its  tableau  has  all  closed  blanches. 

The  proceduie  is  exhaustive  in  the  following  sense:  if  X  and  Y  are  sets  of 
formulas  such  that  X  c  Y  and  Yh^p  but  XM^p,  then  in  the  tableau  for  p,  in  every 
open  blanch  them  is  some  element  of  Y-X  labeled  0. 

For  non -monotonic  logic,  we  nerd  to  generalize  to  tableau  structures.  If  A  is  a 
statement  theory,  and  p  is  a  formula  whose  provability  is  to  be  tested,  then  <A,  p,  t,  X> 
is  an  A -tableau  structure  if  and  only  if  t  is  the  tableau  with  goal  A^p;  and  X  is  the 
smallest  set  such  that  t  f  X,  and  if  t'  e  X,  then  if  Mq  appears  labeled  0  in  some  branch  b 
of  t',  then  r"  €  X,  where  t"  is  the  tableau  with  goal  A^q.  In  this  last  situation,  we  say 
that  t'  mentions  t"  in  branch  b. 

In  the  classical  procedure,  a  tableau  is  closed  if  all  its  branches  are,  and  this  can 
be  detei mined  unambiguously.  In  the  case  of  a  tableau  structure,  we  can't  tell  whether  a 
tahlran  is  c loser  1  until  wr  have  determined  the  status  of  the  tableaux  it  mentions,  and 
there  may  be  loops  to  contend  with. 

IhneToie  wp  mtiodtire  the  notion  of  an  admissible  labeling  of  a  tableau 
sti  ucture,  an  assignment  of  one  label,  either  OPEN  or  CLOSED,  to  each  tableau  in  the 
stiiicture,  such  that: 

(a)  If  (he  tableau  with  goal  A^'q  is  labeled  OPEN,  then  every  occurrence  of  Mq  is 
labeled  1  in  every  tableau,  and 

(b)  A  branch  is  labeled  CLOSED  if  and  only  if  some  formula  is  labeled  both  0  and  1 
in  that  branch. 

I  he  proof  pi  need  1 1  re  creates  tableau  stiuctiires  and  labels  them,  as  follows. 
Given  A  and  p,  the  fust  step  is  to  constimi  the  tableau  with  goal  A:,p.  All  other  tableaux 
needed  are  then  ((instructed.  That  is,  d  some  constructed  tableau  has  a  formula  Mq 
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labeled  0  m  an  open  btanch,  Mien  construct  the  tableau  with  goal  A^q  if  that  tableau 
'va^  not  previously  consti lifted.  I  lie  tableau  suiicture  is  then  checked  for  admissible 
labelings  l>v  examining  all  possible  labelings  of  the  tableaux  for  labelings  satisfying  the 
admissibility  test.  Ibis  trst  consists  of  fust  labeling  with  1  each  occurrence  of  Mq  in  the 
tableau  stuirtute  pmvidrd  that  (lie  stnicline  contains  the  tableau  with  goal  A=>->q  labeled 
OPEN.  I  lien  the  labeling  is  admissible  if  all  tableaux  labeled  OPF.N  bave  some  open 
branch,  and  all  tableaux  labeled  Cl, OSH)  have  evety  branch  closed.  If  in  all  admissible 
labelings  the  initial  tableau  with  goal  A  >p  is  labeled  CLOSED,  then  p  is  piovable,  and 
otherwise  is  improvable.  We  will  shortly  piove  the  conectness  of  this  algorithm. 

We  f  list  present  some  examples.  In  the  theory 
( 2.6)  i'll  =  SC  u  {  MC^D,  MD^E,  ME^F  } 

(see  [39])  the  Til -tableau  stuirtute  for  ->F  has  only  one  admissible  labeling: 


MCn-’O 

t  -F 

|t’  -E 

It"  -0 

1  t* 

’  < 

1 

01 

|  01 

1  01 

1 

01 

MD:>-£ 

ME 

I  MD 

|  MC 

1 

1 

0 

1  0 

1  0 

1 

Ilf  3-f 

1 

CLOSER 

|  OPEN 

I  CLOSED 

1 

OPEN 

Notice  that  we  don’t  bother  to  copy  the  axioms  in  each  tableau,  but  only  those  parts  that 
become  relevant.  The  tableau  structure  shows  that  ->F  e  TH(Tll),  but  ->C  t  TH(Tll). 


Another  example  is  the  T12-tableau  structure  for  ->C,  where 
( 27)  'l  l 2  =  SC  u  {  MD=>-C  }. 


=  MCn-D 

I  t  < 

1  t’ 

-D 

1 

1  oi 

1 

01 

MDd  C 

|  MO 

1 

MC 

1  |  0  |  0 

This  tableau  structure  has  two  admissible  labelings.  If  t’  is  labeled  OPEN,  t  is  labeled 
CLOSED,  and  vice  vena.  So  there  is  an  admissible  labeling  in  which  t  is  labeled  OPEN, 
and  ->C  is  not  piovable. 


On  the  ntliet  hand,  the  T1 2 -tableau  structure  for  MCvMD  looks  like  this: 


2fl 


nr  >  •[) 

1  t 

nr.vtin 

l  f 

-c 

1  t” 

TJ 

l 

1 

0  no 

1 

OJ 

1 

01 

nrb-c 

1 

1 

(ID 

1 

I1C. 

1  I  I  0  I  0 

At’. .iin ,  there  are  two  admissible  labelings,  but  in  both  of  them  t  is  labeled  CLOSED,  so 
MCvMD  is  a  theorem  of  TI2. 

(  I'he  tableau  stnictuies  just  given  are  not  teally  complete.  It  is  left  as  an 
exercise  for  the  icadei  to  show  that  using  the  axioms  to  split  each  tableau  into  branches 
will  not  change  the  ouhomc.) 

Theorem  H.  I  be  pioof  proceduie  always  halts  and  finds  all  admissible  labelings  of  the 
tableau  stiuctuie  foi  ns  goal. 

Proof:  I  be  theorem  is  rauly  seen  tine  by  noting  that  because  the  set  of  proper  axioms 
of  the  theory  is  finite,  only  a  finite  set  of  tableaux  can  be  constiuctcd.  Once  this  is  done, 
there  aie  only  finitely  many  labelings  to  cycle  through,  with  trivial  checks  for 
admissibility  and  piovability.  D 

I  he  next  two  lemmas  guarantee  the  correctness  of  the  a|ijiroach. 

/  rmmn  H.  If  S  is  a  fixed  point  of  NM^,  there  is  an  admissible  labeling  o(  the  tableau 
striimue  for  A ~>p  such  that  |>  p  S  if  and  only  if  the  tableau  is  labeled  CLOSED  in  that 
labeling. 

Proof:  Let  S  p  F P ( A ) .  We  will  construct  the  admissible  labeling.  In  the  tableau 
structure  foi  A-ap,  label  a  tableau  OPEN  if  the  goal  of  the  tableau  is  A^q  and  q  <  S. 
Consider  one  of  (be  remaining  tableaux,  with  goal  \^r.  There  must  be  a  minimal  set  of 
elements  X  =  { Mq j ,  Mq|(},  such  that  X  Asyy(S)  and  XE^r.  If  X  =  **,  then  the 

tableau  foi  A  ~>i  is  closed  no  matter  how  assumptions  are  labeled.  Otherwise,  by 
exhaustiveness,  every  btanrh  of  the  tableau  has  some  Mq  e  X  labeled  0.  So  there  will  be 
a  tableau  foi  each  such  A  ’  *q  .  But  these  tableaux  will  be  labeled  OPEN  (because 
~*n ,  </  S),  so  the  coi responding  bianch  of  the  tableau  for  A  ">r  will  be  CLOSED.  So  the 
whole  tableau  foi  A^r  will  be  CLOSI  D.  Further,  no  open  tableau  will  be  labeled 
CLOSED,  because  then  (line  vvould  be  a  jji oof  of  its  goal  from  assumptions.  Thus,  if  the 
tableau  for  A  >p  is  labeled  CLOSED,  it  can  fie  pioved  from  assumptions  in  As^(S),  so 
P  e  S.  If  it  is  OPEN,  p  S  by  construction.  B 

I  rmmo  T>.  If  thrie  is  an  admissible  labeling  for  the  tableau  structure  for  A^p,  there  is  a 
fixrd  point  S  of  NM^  such  fb.it,  for  rveiy  lahlraii  with  goal  A  >q,  (he  tableau  is  labeled 
CLOSE D  if  and  only  if  q  c  S. 
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Proof :  We  construct  S  fiom  l he  labeling.  I.rt  Rq  be  r hr  set  of  formulas  Mq  such  that  the 
tableau  lot  A  >q  is  labeled  OPEN.  I.et  Sq  =  TIi(AhRq),  and  let  Mqj,  Mq2,  ...  be  an 
eminim  at  ion  of  all  the  Inimulas  of  the  form  Mq  in  -  Rq  ,  with  the  piopeity  that  if  Mq(  is 
a  subexpiession  of  Mq^,  then  i  -  |.  ( E'.p..,  MG  is  a  subexpression  of  M^MC.) 

Define  Rj+j  and  S|4i,  for  1  =  0,1,  ...  as  follows: 

R, +l  =  R,  if  "tljal  c  Si>  p|-r  Ri  r  R,LliMfl,4l}.  and 

S, ^  =  Th(  A» 'Ri  +  , ). 

Now  let  S  =  f. f i-‘n  S(,  and  R  =  U,To  R,.  Clearly,  S,  G  S|4j  and  S  =  Th(AuR). 

Since  NMA(S)  =  l  h(  AuAs^(S) ) ,  we  can  show  that  NM^(S)  =  S  by  showing  that 

R  =  AsA(S). 

First,  to  show  AsA(S)  G  R.  Let  t  S.  We  will  show  Mq  e  R.  If  Mq  €  Rq,  then 

since  Rq  g  R,  Mq  r  R.  Otherwise  q  must  be  some  q(.  If  ■’q  £  S,  then  -•q  <  S|_j,  so 

Mq  e  R ^ ,  so  Mq  c  R. 

Second,  to  show  R  G  AsA(S),  that  is,  if  Mq  c  R,  then  -’q  £  S.  There  are  two 

cases.  If  Mq  g  Rq,  then  there  is  an  OPFN  tableau  for  A^q.  Assume  that  ->q  e  S.  Then 

tlmie  must  be  a  kH  such  that  ->q  e  Sj.  and  ->q  Sj._j.  So  R^^"^  an<^  ^k-l^A"^-  Rut 
then  by  exhaustiveness,  Mq^,  is  labeled  0  in  the  tableau  for  A^q.  So  there  is  also  a 
tableau  foi  A  -q^.  If  this  tableau  is  OPFN,  then  Mq^  e  Rq.  If  this  tableau  is  CLOSED, 
Mq €  Sq,  and  hence  Mq^  e  F.ithei  way,  R^  =  Rj^.j,  which  is  impossible. 

In  the  other  case,  q  will  be  some  q(,  so  Mq  e  R()  and  -q  £  Si  i.  Assume  that 
-■q  f  S,  that  is,  --q  is  an  element  of  some  S^,  k?i,  and  -q  £  S^.j.  Then  R^  hA  ^q  but 
Rk-1  ^A  50  {Mqk>MRk_1  hA  ->q. 

Now,  Mq^  does  not  occur  as  a  subexpression  of  q  =  q(  (since  k >i ) ,  so  Mq^  must 

occiii  in  the  axioms  A.  So  in  some  branch  of  she  tableau  for  A^q,  Mqk  must  be  labeled 

0.  But  this  means  that  Mq^  must  be  labeled  0  in  some  branch  of  the  tableau  for  A^p,  for 
any  p.  So  any  tableau  structuie  must  have  a  tableau  for  A^q^.  This  tableau  must  be 
OPFN,  or  -'q^  would  be  a  member  of  Sq,  and  hence  a  member  of  S^._p  So  Mq^  €  Rq,  so 
Rk  =  Rk-I'  wD!r h  is  a  c ontt ad ict ion. 

It  remains  to  show  that  the  labels  agree  with  the  fixed  point.  If  the  tableau  for 
A  >->q  is  OPFN,  then  Mq  c  S  by  constiuction.  If  it  is  CLOSED,  there  is  a  proof  of  ->q 
from  Rq,  so  --q  e  Sq.  But  Sq  g  S,  so  the  final  labeling  agrees  as  well.  I 
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T/irotnn  16.  If  A  is  a  statement  theory  (a  finite  extension  of  the  sentential  calculus),  then 
non  monotonic  piovalulitv  in  A  is  decidable. 

Proof :  I. el  <A,  p,  i,  V>  hr  ihe  lahleau  stmctuie  for  a  formula  p.  If  the  piocedtue  labels 
t  Cl.OSt.l)  111  eveiv  adniiss>t,|r  labeling,  then  theie  is  no  fixed  point  of  NM^  which  does 
not  contain  p,  since  theie  thru  would  be  an  OPF.N  labeling.  So  p  is  in  all  fixed  points, 
and  hence  provable.  ||  the  piocrdme  laliels  t  OPt.N  in  some  admissible  labeling,  there  is 
a  fixed  point  of  NM^  which  does  not  contain  p,  so  p  is  improvable.  B 

Ihe  pniof  procedure  extends  a  previous  procedure  clue  to  Hewitt  [12],  and 
embodied  in  Mu  to  Pl.ANNf  R  1431,  a  computer  programming  language  for  (among  other 
things)  mechanical  theoiem  pioving.  A  piactical  implementation  of  this  procedure  would 
intei leave  the  huildttig  and  labeling  of  tableaux,  and  would  avoid  building  a  complete 
tableau  stmctuie  when  unnecessary.  We  invite  you  to  compare  this  ptocedure  with,  for 
instance,  the  tableau- structure  method  for  SS.  f  1 4 3  One  difference  between  these 
procedures  is  that  the  present  piocrdme  splits  tableaux  into  branches  before  generating 
alternatives,  while  ihe  S.r>  procedure  splits  the  whole  set  of  alternatives  into  branches. 


10.  The  Truth  Maintenance  System 

I  lie  only  known  adequate  solutions  to  the  handling  of  non -monotonic  proofs  are 
Povle's  TM  IMS  pmgiam  and  its  relatives  [21,  231.  With  our  theoretical  results  in  hand, 
we  can  piesent  a  description  of  what  this  program  does.  The  IMS  has  two  basic 
lesponsibilities: 

(a)  It  maintains  a  data  base  of  proofs  of  formulas  generated  by  an  independent 
pioof  proceduie  oi  perceptual  program.  In  our  terms  its  goal  is  to  avoid  the  presence  of 
both  q  and  Mq  in  the  data  base  simultaneously. 

(b)  It  detects  inconsistencies,  and  adds  axioms  to  a  theory  in  order  to  eliminate  them. 

I  lie  IMS  keeps  track,  for  each  formula  in  the  data  base,  of  the  formula’s 
juitifinitions.  A  justification  of  a  formula  p  is  a  set  {pj,  ...  pn)  of  formulas  which  entail 
p.  Such  a  justification  may  be  viewed  as  a  fragment  of  the  tableau  for  A^p;  that  is,  for 
each  branch  of  p's  tableau,  the  justification  contains  a  formula  p(  labeled  0  in  that 
hi  anch. 


Ihe  basic  IMS  algorithm  seaiches  for  a  labeling  of  formulas  involved  in 
justifications.  It  obeys  two  irrinciples;  |i  is  labeled  ]  if  and  only  if  all  the  formulas  in 
some  justification  of  |>  are  libeled  1,  and  M|i  is  labeled  1  if  and  only  if  ->p  is  labeled  0. 
When  the  IMS  finds  a  labeling  satisfying  these  conditions,  it  arranges  the  data  base  so 
that  only  fotimilas  labeled  J  are  "visible"  to  the  higher  level  proof  |nocedurc  oi  program. 
I  hus,  fiom  the  point  of  view  of  a  program  using  the  I  MS,  it  chooses  a  subset  of  formulas 
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to  "believe".  I  liesr  foimnlas  air  said  to  be  in ;  t he  otliri  formulas  are  out. 

This  is  reminiscent  of  our  pi  oof  pioccdure's  search  for  admissible  tableau 
labelings,  but  tlieie  aie  some  impottant  differences.  The  I  MS  opriates  on  partial  sets  of 
tableau  fiagments,  so  ns  decisions  may  require  revision  as  new  fragments  ( justifications) 
ate  discovered.  Put  tlieie  is  a  mote  sinking  difference  between  our  proof  procedure  and 
the  IMS.  I  lie  IMS  searches  foi  just  one  admissible  labeling  of  its  tableau  fragments,  not 
all  such  I abcluigs.  The  most  it  <an  hope  to  find  is  one  fixed  point  (actually,  a  finite 
subset  of  one),  not  all  of  them.  In  the  (eiminology  we  developed  earlier,  it  finds  some  of 
the  arguable  fntmulas  ratliei  the  than  provable  formulas.  For  example,  consider  its 
behavicn  on  the  theory  Tl?  in  (?T).  In  tins  theory,  MG  is  arguable,  and  so  is  MD,  but 
neithei  is  provable  (only  MGvMI)  is  provable).  Nonetheless,  the  TMS,  given  the 
justifications  {MG}  of  -D  and  (Ml)}  of  ’C,  will  pick  one  of  {MC,  MO}  to  be  in,  and  the 
other  to  be  out. 

Theie  ate  several  reasons  for  such  jumping  to  conclusions.  One  is  that  since  all 
arguable  formulas  air  also  assumable,  these  decisions  may  at  worst  lead  to  later  shifts  in 
fixed  points.  That  is,  since  arguable  formulas  might  be  added  consistently  later  on,  it 
cannot  hurt  much  to  act  on  die  assumption  that  they  will  be  added.  A  more  pressing 
rationale  for  this  behavior  is  that  the  piogram  or  proof  procedure  using  the  TMS  typically 
depends  on  beliefs  of  ceitain  types  to  decide  what  to  do,  and  cannot  abide  by  suspended 
judgement;  even  if  there  is  a  choice  of  possible  circumstances,  the  program  expects  the 
TMS  to  decide  on  one  so  that  action  may  he  taken. 


Of  couise,  jumping  to  conclusions  in  this  manner  introduces  the  problem  of 
having  to  choose  between  fixed  points  of  the  theory.  In  many  cases  this  pioblem  solves 
itself  because  of  the  way  the  I  MS  is  typically  used.  Usually  a  program  using  the  I  MS  is 
attempting  to  discover  which  fixed  point  of  a  theory  corresponds  to  the  real  world.  The 
best  wav  to  do  this  is  to  pick  one  model  and  stick  with  it  until  trouble  arises,  and  then 
salvage  as  much  information  as  possible  by  making  as  few  changes  as  necessary. 
"Trouble"  can  take  the  foim  of  new  infot nation  or  new  deductions  from  old  information 


■conflicting  with  old  mfo  matmn  or  assumptions.  Father  way,  the  response  is  the  same;  to 
switch  to  a  new  fixed  point.  Programs  frequently  tiy  to  organize  their  use  of  the  TMS  so 
as  to  enstne  the  race  of  a  single  fixed  point  being  the  usual  case.  However,  it  is  not 
possible  to  completely  determine  in  this  fashion  how  the  I  MS  should  decide  between 
alternate  fixed  points.  One  wav  even  more  information  of  this  sort  might  be  used  would 
be  to  employ  Reseller’s  (3f1  suggestion  of  modal  categories  as  a  method  for  selecting  among 
the  vat  ions  fixed  points  gennaied  by  a  theory.  That  is,  suppose  the  formulas  of  the 
language  ate  segmented  into  n‘l  modal  catrgoiies  I.  =  MqU...uM  .  Then  given  fixed  points 
of  a  them v  A  as  Sj,  ...,  Sm,  with  corresponding  sets  of  assumptions  Aj,  ....  Am,  we  can 


on  the  vri  1.115.  of  assumption  components.  Acklmp  Midi  devices  lo  I  MS  like  sysrenis  is  an 
int.’i estinf;  topic  foi  f min r  research. 

I  lie  two  goals  of  the  I  MS,  lo  pi  event  both  -.p  and  Mp  being  in,  and  to  pi  event 
both  p  and  >|>  being:  in,  give  rise  to  two  diffeient  types  of  activity.  In  the  first  case,  when 
a  new  justification  is  discovered  for  some  formula  which  then  invalidates  some  current 
assumption,  the  IMS  must  reexamine  the  ament  labeling  to  find  a  new  labeling 
consonant  with  the  enlaiged  set  of  justifications.  This  process  is  fanly  straightforward, 
although  there  aie  important  spec  ■  a  I  cases  concerning  circular  proofs  which  require  spec  i  a  1 
care.  I  his  process  thus  takes  on  the  ajrpearance  of  a  relaxation  procedure  for  finding  an 
acceptable  labeling,  and  then  determination  of  non-circular  proofs  for  all  formulas 
labeled  1 . 

I  Im  second  type  of  inconsistency  handled  by  the  I  MS,  that  of  p  and  -■p  being 
in,  requires  somewhat  diffeient  treatment.  In  the  first  type  of  process  just  described,  the 
IMS  uses  justifications  m  a  iiiudiiection.il  manner,  detei mining  labelings  of  formulas  from 
the  labelings  of  the  fnimulas  of  then  justifications,  and  not  vice  rer.tn.  In  the  second  case, 
the  IMS  must  ttaverse  these  justifications  in  the  ojjjiosite  direction,  seeking  the 
assumptions  underlying  the  conflicting  formulas.  To  resolve  the  inconsistency  of  these 
assumptions,  the  IMS  converts  the  problem  to  one  of  the  fust  tyjie  by  |iroducing  a  new 
justification  for  the  denial  of  one  of  the  assumptions  in  terms  of  the  other  assumptions. 
Ibis  might  be  viewed  as  the  IMS  sharing  the  weakness  of  our  logic;  it  cannot  rule  out 
an  assumption  M|i  by  deriving  •'M|i)  but  must  nr-tead  produce  a  deiivation  of  -'p.  This 
second  process  is  called  dependency-directed  backdating  C421 

For  exanqile,  the  existing  tlieniy  may  be  {  MC=>F.  }  in  which  both  MC  and  E 
aie  believed.  Adding  the  axiom  MI)r>-.F  leads  to  an  inconsistent  theoiy,  as  ML)  is  assumed 
(thete  being  no  jiioof  of  -T)),  which  leads  to  proving  ->E.  The  dejiendency-directed 
backdating  luncess  would  trace  the  |itoofs  of  F  and  ->E,  find  that  two  assumptions,  MC 
and  Ml),  wrte  res|ioiisihle.  Just  concluding  -’MCv-'MD  does  no  good,  since  this  does  not 
tule  out  any  assumptions,  so  the  I  MS  adds  the  new  axiom  E-~»->D  which  invalidates  the 
assumption  Ml)  and  so  restores  consistency.  Tlieie  aie  many  subtleties  involved,  as 
discussed  m  m. 

Of  ccitiise,  in  non-inonotomc  logic  (line  is  also  anothei  kind  of  inconsistency, 
that  due  lo  there  being  no  fixed  point  at  all.  I  lie  I  MS  can  loop  foirver  in  some  cases 
when  piesented  with  a  theoiy  containing  an  inconsistent  subtheoty  of  this  sort.  Notmally, 
however,  this  does  not  ha|i|ien.  13]  desciihrs  some  conditions  on  the  structure  of  the  set 
of  justifications  under  which  a  simplified  variant  of  the  I  MS  can  be  shown  to  always  hall. 
Mr  Allester's  [23  J  I  MS,  through  a  diffeient  organisation,  apparently  avoids  these  problems. 
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II  Di*.t  ii ss jf>n 

In  conli.iU  to  classical  logics,  thr  nonmonotonic  logics  examined  in  tins  paper 
have  the  |MO|>ritv  th.it  c.\ trn«l infi  .1  tlieoiy  dors  not  always  leave  all  theorems  of  the 
oiii'.inal  theory  intact.  Such  logics  ;ue  of  great  practical  mteicst  in  atttficial  intelligence 
leseaich,  hut  have  suffered  from  foundational  weakness.  We  have  tried  to  repair  this 
weakness  |»y  pmvidmg  analvsrs  of  non  nmnotonk  piovahility  and  semantics.  Our 
definitions  lead  to  piools  of  the  completeness  of  non  monotonic  logic  and  the  decidability 
of  the  non  monotonic  sentential  calculus. 

The  aie.a  ol  nonmonotonic  logic  is  ripe  for  further  research.  Some  open 
pioblenis  have  been  mentioned  111  the  preceding  sections.  In  the  following,  we  list  some 
furtlici  inteiestmg  topics. 

The  major  pioblem  for  non -monotonic  logic  is  deciding  provability  for  more 
general  cases  than  statement  theories.  Unlike  classical  logic,  it  appears  that  the  non¬ 
monotonic  predicate  calculus  is  nut  even  semi -decidable.  That  is,  there  seems  to  be  no 
procedure  which  will  tell  you  when  something  is  a  theorem.  If  there  were,  then  we  could 
use  it  to  decide  whethei  p  was  a  theorem  of  number  theory  by  trying  to  prove  p  and  Nhp 
simultaneously,  since  one  of  these  must  he  a  theoiem  (as  there  is  only  one  nonmonotonic 
fixed  point  of  number  theory). 

Are  theie  sprnal  cases  in  which  provability  is  decidable  or  semi-decidable?  We 
conjecture  that  many  thrones  of  interest  to  artificial  intelligence  are  asymptotically 
ilccidal’/c,  in  the  following  sense;  theie  is  a  procedure  which  is  allowed  to  change  its 
answer  an  indefinite  numbet  of  times  about  whethei  a  formula  is  provable,  but  changes 
its  answer  only  a  finite  number  of  times  on  each  particular  foimula.  (See  for  example  the 
problem  solving  procedures  given  in  (S3.  Note  also  that  classical  first-order  provability  is 
asymptotically  decidable  by  a  procedure  that  changes  its  answer  only  once;  answer 
"improvable"  and  then  call  any  complete  proof  procedute,  changing  the  answer  if  the 
proof  piocrdure  succeeds.)  Asymptotic  decidability  is  a  fairly  weak  property  of  a 
predicate,  but  it  isn't  vacuous  since  there  ate  piedicatcs  (such  as  totality)  which  are  not 
decidable  even  in  (his  sense.  Furthermore,  a  procedure  of  this  kind  could  be  useful  in 
spite  of  the  provisional  nature  of  its  outputs,  since  a  robot  always  has  to  act  on  the  basis 
of  incomplete  cogitation.  Unfortunately,  it  appears  that  even  for  some  finite  first-order 
theories,  provability  is  not  asymptotically  decidable.  We  must  look  for  useful  special  cases. 

W e  have  presented  a  foimali7ation  of  non  monotonic  logic  which,  although  very 
weak,  captures  most  of  the  important  properties  desired,  especially  with  regard  to  the 
structure  of  models  of  non  monotonic  theories  and  their  behavior  upon  extension  by  new 
axioms.  The  logic  seems  to  hr  adequate  for  describing  the  TNIS,  an  ability  following 
naturally  from  the  stiuctuic  and  evolution  pioperties  just  mentioned.  The  logic  also 
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admits  a  pmof  of  completeness  and  a  pioof  prncrdtire  lot  the  case  of  statement  theories. 

Unloitutiatelv,  the  weakness  of  thr  logic  manifests  itself  in  some  disconcerting 
exceptional  cases  which,  while  essentially  inelevant  to  the  strnctuie  and  evolution 
piopeities,  indicate  that  the  logic  fails  to  capture  a  coheient  notion  of  consistency.  For 
example,  the  theory 

(28)  T13  =  PC  ti  {  MC->[),  ->1)  } 

is  inconsistent  in  our  logic  because  although  -MC  follows  from  -•[)  and  MC^D,  -’C  does 
not  follow,  thus  allowing  MC  to  he  assumed;  and  so  the  theory  fails  to  have  a  fixed 
(joint.  This  can  he  remedied  hy  extending  the  throiv  to  include  ->C,  the  approach  taken 
by  the  TMS,  but  this  extension  seems  arhitiary  to  the  casual  observer.  As  it  happens, 
axioms  like  MC->L)  air  much  less  common  in  applications  than  the  unproblematic  MC^C, 
but  it  would  be  nice  to  get  i id  of  this  problem.  Another  incoherence  of  our  logic  is  that 
consistency  is  not  distributive;  MC  dors  not  follow  fiom  MECaDT  Our  logic  tolerates 
axioms  which  force  an  incoherent  notion  of  consistency,  as  in 

(29)  TJ4  =  PC  0  {  MC,  ->C  }. 

A  sponger  logic  might  not  allow  this  by  foicmg  such  theoiies  to  he  inconsistent.  We  think 
that  such  logics  are  available,  and  will  report  their  details  in  a  forthcoming  paper. 
Boolos's  E2)  System  C  gives  some  hints  about  the  fotm  of  logics  of  provability. 

There  ate  several  problems  of  a  mathematical  nature  raised  by  non-monotonic 
logic.  What  air  the  details  of  the  relationship  between  non-monotonic  logic  and  the  logics 
of  incomplete  information?  What  ate  the  effects  of  different  rules  of  inference  on  the 
construction  of  non -monotonic  models?  What  are  the  details  of  the  evolution  of  the 
properties  of  decision  and  provability?  Aie  (here  interpretations  of  non  monotonic  logic 
within  classical  logics?  Aie  there  connections  between  non-monotonic  logic  and  logics  with 
statements  of  infinite  length?  Is  there  a  topological  interrelation  of  non  monotonic  logic 
in  analogy  to  the  topological  intci  pi  nation  of  the  intuit  ionistic  calculus? 

There  are  also  a  number  of  mote  speculative  and  long  range  topics  for 

investigation  taised  bv  non-monotonic  logic.  The  revision  of  beliefs  performed  by 

artificial  intelligence  piograms  can  be  viewed  as  a  microscopic  veision  of  the  process  of 
change  of  scientific  theories.  (For  a  figurative  description  of  such  processes  which  is  very 
close  to  a  true  description  of  non-monotonic  logic  and  the  I  MS,  see  the  beginning  of 
section  6  of  Quine's  Two  Dogmas  of  Empiricism.  r.12])  Can  the  ideas  captured  in  non¬ 
monotonic  logic  he  used  to  describe  the  general  process  of  scientific  discovery,  or 

pragmatic  hehaviot  in  general?  How  arc  the  holistic  semantics  of  non  monotonic  logic 
related  to  changes  in  meanings?  (Cf.  particularly  E71.)  What  are  the  trade-offs  involved 
in  jumping  tn  conclusions?  How  costly  is  the  suspension  of  judgement?  Can  non¬ 
monotonic  logic  he  used  to  effectively  clesciihe  and  reason  about  actions,  commands, 
coiinlerfartuals,  and  causality? 
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